Vendor

    WPEverest

    79 known vulnerabilities in products by WPEverest, 0 of them actively exploited (CISA KEV).

    Key figures

    79

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WPEverest
    CriticalCVE-2026-3300

    Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

    		9.8
    CriticalCVE-2026-1492

    Improper Privilege Management (CVE-2026-1492)

    		9.8
    CriticalCVE-2025-1128

    Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion

    		9.8
    CriticalCVE-2026-3296

    Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata

    		9.8
    HighCVE-2025-2563

    User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation

    		8.1
    HighCVE-2025-2594

    User Registration & Membership < 4.1.3 - Authentication Bypass

    		8.1
    CriticalCVE-2019-13575

    Everest Forms: SQL Injection

    		9.8
    CriticalCVE-2023-3342

    User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload

    		9.9
    CriticalCVE-2025-3439

    Everest Forms: Deserialization of Untrusted Data

    		9.8
    CriticalCVE-2026-62103

    WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

    		9.8
    CriticalCVE-2026-74001

    WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability

    		9.8
    HighCVE-2026-5478

    Path Traversal (CVE-2026-5478)

    		8.1
    CriticalCVE-2026-4882

    User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload

    		9.8
    HighCVE-2023-3343

    User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection

    		8.8
    HighCVE-2024-2417

    Missing Authorization (CVE-2024-2417)

    		8.8
    HighCVE-2026-92798

    Code Injection (CVE-2026-92798)

    		8.1
    MediumCVE-2026-91153

    Exposure of Sensitive Information to an Unauthorized Actor (CVE-2026-91153)

    		5.3
    CriticalCVE-2025-60210

    WordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection Vulnerability

    		9.8
    HighCVE-2025-5927

    Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion

    		7.5
    MediumCVE-2026-6203

    Open Redirect (CVE-2026-6203)

    		6.1
    HighCVE-2026-96660

    Cross-site Scripting (CVE-2026-96660)

    		7.2
    MediumCVE-2026-91152

    Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter

    		6.1
    HighCVE-2026-87111

    User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header

    		7.2
    MediumCVE-2024-3295

    Missing Authorization (CVE-2024-3295)

    		6.5
    MediumCVE-2021-24689

    Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Admin+ Arbitrary System File Read

    		4.9

    All vulnerabilities in search

    News

    Products

    Products by WPEverest
    User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder280
    User Registration200
    Everest Forms180
    Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder80
    User Registration \& Membership80
    Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder With AI40
    Everest Forms Pro40