wpeverest has 8 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 5. The median CVSS is 7.2 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (4), User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin (1), everest-forms (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Products
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4
- User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin 1
- everest-forms 1
- everest_forms_frontend_listing 1
- user-registration 1
Worst active — by depth score
CVE-2026-62103Critical· 9.8WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability54CVE-2025-60210Critical· 9.8Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.54CVE-2026-92798High· 8.1User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag45CVE-2026-96660High· 7.2User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value40CVE-2026-87111High· 7.2The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due…40
wpeverest vulnerabilities
CVEs affecting wpeverest, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-92978Medium· 4.3User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up …
CVE-2026-96660High· 7.2User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field…
CVE-2026-92798High· 8.1User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::…
CVE-2026-87111High· 7.2The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due…
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due…
CVE-2026-15222Medium· 5.4The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi…
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi…
CVE-2026-74017Medium· 5.3Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
CVE-2026-62103Critical· 9.8WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
CVE-2025-60210Critical· 9.8Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.
Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.