CVE-2026-62103WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product E Everest Forms Published 09/11/2026 Severity Critical CVE-2026-5096Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI Published 08/28/2026 Severity Medium CVE-2026-74001WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability Exploitation status Not known exploited Fix Affected product U User Registration & Membership Pro Published 08/20/2026 Severity Critical CVE-2026-73995WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 08/18/2026 Severity Medium CVE-2026-13167Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI Published 08/16/2026 Severity Medium CVE-2026-73403WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 08/13/2026 Severity Medium CVE-2026-12124PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter Exploitation status Not known exploited Fix Affected product P PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer Published 07/28/2026 Severity Medium CVE-2026-57312WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product E Everest Forms Published 06/26/2026 Severity High CVE-2026-1869User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 06/26/2026 Severity Medium CVE-2026-7651User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 05/28/2026 Severity Medium CVE-2026-4888Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Published 05/27/2026 Severity Medium CVE-2026-6145User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 05/14/2026 Severity Medium CVE-2026-3601User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 05/05/2026 Severity Medium CVE-2026-4882User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload Exploitation status Not known exploited Fix Affected product U User Registration Advanced Fields Published 05/02/2026 Severity Critical CVE-2026-42652WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 04/29/2026 Severity High CVE-2026-5478Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Published 04/20/2026 Severity High CVE-2026-6203User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 04/13/2026 Severity Medium CVE-2026-1865User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 04/08/2026 Severity Medium CVE-2026-3296Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Published 04/08/2026 Severity Critical CVE-2026-3300Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field Exploitation status Not known exploited Fix Affected product E Everest Forms Pro Published 03/31/2026 Severity Critical CVE-2026-32488WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 03/25/2026 Severity High CVE-2026-4056User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 03/23/2026 Severity Medium CVE-2026-27070WordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product E Everest Forms Pro Published 03/19/2026 Severity High CVE-2026-1492User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 03/03/2026 Severity Critical CVE-2026-1779User Registration & Membership <= 5.1.2 - Authentication Bypass Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 02/26/2026 Severity High CVE-2026-2356User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 02/26/2026 Severity Medium CVE-2026-22422WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability Exploitation status Not known exploited Fix Affected product E Everest Forms Published 02/19/2026 Severity Medium CVE-2026-24353WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 01/22/2026 Severity Medium CVE-2025-67956WordPress User Registration plugin <= 4.4.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 01/22/2026 Severity High CVE-2025-14976User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 01/10/2026 Severity Medium CVE-2025-13367User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 12/15/2025 Severity Medium CVE-2025-8871Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature Exploitation status Not known exploited Fix Affected product E Everest Forms Pro Published 11/05/2025 Severity Medium CVE-2025-60210WordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection Vulnerability Exploitation status Not known exploited Fix Affected product E Everest Forms - Frontend Listing Published 10/22/2025 Severity Critical CVE-2025-9085User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 09/06/2025 Severity Medium CVE-2025-6831User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 07/22/2025 Severity Medium CVE-2025-5927Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion Exploitation status Not known exploited Fix Affected product E Everest Forms Pro Published 06/25/2025 Severity High CVE-2024-8542Everest Forms < 3.0.3.1 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product E Everest Forms Published 05/15/2025 Severity Medium CVE-2025-26841Exploitation status Not known exploited Fix Not confirmed Affected product Not confirmed Published 05/12/2025 Severity Medium CVE-2025-3281User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 05/06/2025 Severity Medium CVE-2025-39400WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 04/24/2025 Severity High CVE-2025-2594User Registration & Membership < 4.1.3 - Authentication Bypass Exploitation status Public exploit Fix Affected product U User Registration & Membership Published 04/22/2025 Severity High CVE-2025-3284User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion Exploitation status Not known exploited Fix Affected product U User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin Published 04/19/2025 Severity Medium CVE-2025-2563User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation Exploitation status Public exploit Fix Affected product U User Registration & Membership Published 04/14/2025 Severity High CVE-2025-3282User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 04/12/2025 Severity Medium CVE-2025-3292User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 04/12/2025 Severity Medium CVE-2025-3421Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Published 04/11/2025 Severity Medium CVE-2025-3422Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Published 04/11/2025 Severity Medium CVE-2025-3439Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Published 04/11/2025 Severity Critical CVE-2025-30899WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 03/27/2025 Severity Medium CVE-2025-1511User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 02/28/2025 Severity Medium CVE-2025-1128Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Published 02/25/2025 Severity Critical CVE-2024-13125Everest Forms < 3.0.8.1 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product E Everest Forms Published 02/13/2025 Severity Low CVE-2023-29429WordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 12/09/2024 Severity Medium CVE-2024-10471Everest Forms < 3.0.4.2 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product E Everest Forms Published 11/26/2024 Severity Medium CVE-2023-51377WordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product E Everest Forms Published 06/14/2024 Severity Medium CVE-2024-4958User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 06/01/2024 Severity High CVE-2024-2417User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 05/02/2024 Severity High CVE-2024-3295User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 05/02/2024 Severity Medium CVE-2024-1812Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url Exploitation status Not known exploited Fix Affected product E Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Published 04/09/2024 Severity High CVE-2023-27459WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product U User Registration Published 03/26/2024 Severity High CVE-2024-1720User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 03/07/2024 Severity Medium CVE-2023-51695WordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product E Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! Published 02/01/2024 Severity Medium CVE-2023-5228User Registration < 3.0.4.2 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product U User Registration Published 11/06/2023 Severity Medium CVE-2023-3342User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 07/13/2023 Severity Critical CVE-2023-3343User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection Exploitation status Not known exploited Fix Affected product U User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Published 07/13/2023 Severity High CVE-2023-23987WordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product U User Registration Published 04/06/2023 Severity Medium CVE-2022-3912User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload Exploitation status Public exploit Fix Affected product U User Registration Published 12/12/2022 Severity High CVE-2021-24689Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Admin+ Arbitrary System File Read Exploitation status Not confirmed Fix Not confirmed Affected product C Contact Forms – Drag & Drop Contact Form Builder Published 02/28/2022 Severity Unknown CVE-2021-24907Everest Forms < 1.8.0 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product C Contact Form, Drag and Drop Form Builder for WordPress – Everest Forms Published 12/21/2021 Severity Unknown CVE-2021-24654User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting Exploitation status Not confirmed Fix Affected product U User Registration – Custom Registration Form, Login And User Profile For WordPress Published 10/04/2021 Severity Unknown CVE-2019-13575Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 07/18/2019 Severity Unknown 
