WPEverest has 5 CVEs on record between 2025 and 2026. 4 were published in the last 90 days. The median CVSS is 7.2 (high), with 2 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 1
- User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin 1
- everest-forms 1
- everest_forms_frontend_listing 1
- user-registration 1
Worst active — by depth score
CVE-2026-62103Critical· 9.8WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability54CVE-2025-60210Critical· 9.8Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.54CVE-2026-87111High· 7.2User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header40CVE-2026-15222Medium· 5.4User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name30CVE-2026-74017Medium· 5.3Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.29
WPEverest vulnerabilities
CVEs affecting WPEverest, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-87111High· 7.2User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due…
CVE-2026-15222Medium· 5.4User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi…
CVE-2026-74017Medium· 5.3Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
CVE-2026-62103Critical· 9.8WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
CVE-2025-60210Critical· 9.8Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.
Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.