Search
Find a vulnerability
Search criteria
166 vulnerabilities by wpeverest
CVE-2026-115483 (GCVE-0-2026-115483)
Vulnerability from nvd – Published: 2026-11-10 19:31 – Updated: 2026-11-12 15:50
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
Summary
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check, without validating or restricting the path. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, such as wp-config.php, which can contain sensitive information. Successful exploitation requires a form whose email notification has the “Attach Files” setting enabled and that contains a field with a meta key matching /signature_/ (for example, a text field labelled “Signature”), with the notification routed to an attacker-supplied email address so the exfiltrated file is delivered to the attacker. Note: The Everest Forms Pro add-on is required to exploit this vulnerability, as it provides the signature field and the email file-attachment functionality (file-email-attachments) that the attack relies on.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 15:50 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
15 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T15:50:05.382869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T15:50:23.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Maciej Komorowski"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check, without validating or restricting the path. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, such as wp-config.php, which can contain sensitive information. Successful exploitation requires a form whose email notification has the \u201cAttach Files\u201d setting enabled and that contains a field with a meta key matching /signature_/ (for example, a text field labelled \u201cSignature\u201d), with the notification routed to an attacker-supplied email address so the exfiltrated file is delivered to the attacker. Note: The Everest Forms Pro add-on is required to exploit this vulnerability, as it provides the signature field and the email file-attachment functionality (file-email-attachments) that the attack relies on."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:31:31.738Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03f636e6-271d-4516-8db1-dc268ff794e7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1727"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1728"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1735"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1793"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1816"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1824"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1637"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1645"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1717"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/evf-entry-functions.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/evf-entry-functions.php#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/evf-core-functions.php#L1249"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/class-evf-form-task.php#L1504"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3786305/everest-forms"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-22T15:28:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-10T06:49:17.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.3 - Unauthenticated Arbitrary File Read via \u0027Signature\u0027 Field Meta Key Branch of attach_entry_files"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-115483",
"datePublished": "2026-11-10T19:31:31.738Z",
"dateReserved": "2026-10-22T15:13:09.363Z",
"dateUpdated": "2026-11-12T15:50:23.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120513 (GCVE-0-2026-120513)
Vulnerability from nvd – Published: 2026-11-10 06:47 – Updated: 2026-11-12 18:03
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
Summary
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:37 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120513",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:37:41.741628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T18:03:49.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SAHRAOUI AYMEN"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the \u0027Disable storing entry information\u0027 setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T06:47:01.101Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d61468b-8fda-4775-8099-a34ddf34566b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/abstracts/class-evf-form-fields-upload.php#L1680"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/class-evf-form-task.php#L594"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/abstracts/class-evf-form-fields-upload.php#L1396"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/class-evf-ajax.php#L681"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3747723/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-09T16:32:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-09T18:20:39.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.2 - Unauthenticated Arbitrary File Deletion via \u0027everest_forms_{form_id}_old_{field_id}\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-120513",
"datePublished": "2026-11-10T06:47:01.101Z",
"dateReserved": "2026-11-02T16:12:49.399Z",
"dateUpdated": "2026-11-12T18:03:49.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89101 (GCVE-0-2026-89101)
Vulnerability from nvd – Published: 2026-11-06 11:17 – Updated: 2026-11-06 15:15
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
Summary
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 15:11 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89101",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:11:31.472742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:15:20.139Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Trgomez"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user \u2014 including personally identifiable information submitted through public contact and lead forms \u2014 regardless of form ownership."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T11:17:35.493Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fabe52a-b51e-4383-ac88-8f30e083c9bb?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L669"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L686"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L563"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L30"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L46"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-mcp-server.php#L52"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-registry.php#L74"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/includes/abilities/class-evf-abilities-handlers.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-10T21:48:37.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-05T22:19:09.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-89101",
"datePublished": "2026-11-06T11:17:35.493Z",
"dateReserved": "2026-09-10T21:48:21.571Z",
"dateUpdated": "2026-11-06T15:15:20.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27061 (GCVE-0-2026-27061)
Vulnerability from nvd – Published: 2026-10-30 18:30 – Updated: 2026-10-30 19:00
VLAI
EPSS
VEX
Title
WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
Summary
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:46 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration |
Affected:
n/a , ≤ 5.3.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T18:46:15.638931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:00:20.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "user-registration",
"product": "User Registration",
"vendor": "wpeverest",
"versions": [
{
"changes": [
{
"at": "5.3.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.3.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Filip Kowalski | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Subscriber Cross Site Scripting (XSS) in User Registration \u003c= 5.3.0 versions."
}
],
"value": "Subscriber Cross Site Scripting (XSS) in User Registration \u003c= 5.3.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:30:31.909Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 5.3.1 or a higher version."
}
],
"value": "Update to 5.3.1 or a higher version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress User Registration plugin \u003c= 5.3.0 - Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-27061",
"datePublished": "2026-10-30T18:30:31.909Z",
"dateReserved": "2026-02-17T13:23:42.766Z",
"dateUpdated": "2026-10-30T19:00:20.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91153 (GCVE-0-2026-91153)
Vulnerability from nvd – Published: 2026-10-29 09:25 – Updated: 2026-10-29 10:45
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
Summary
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 10:31 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T10:31:31.954808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:45:40.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "muhammad nizar"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values \u2014 including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type \u2014 via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T09:25:36.385Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b820a342-3aaa-4782-9d82-afe53028b72c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-smart-tags.php#L503"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-form-task.php#L731"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-form-task.php#L261"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-ajax.php#L681"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-ajax.php#L2342"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/shortcodes/class-evf-shortcode-form.php#L370"
},
{
"url": "https://github.com/themegrill/everest-forms/pull/1669/changes"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3747723/everest-forms/trunk/includes/class-evf-form-task.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T20:55:04.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-28T20:44:11.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91153",
"datePublished": "2026-10-29T09:25:36.385Z",
"dateReserved": "2026-09-14T20:40:00.677Z",
"dateUpdated": "2026-10-29T10:45:40.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91152 (GCVE-0-2026-91152)
Vulnerability from nvd – Published: 2026-10-29 09:25 – Updated: 2026-10-29 10:45
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
Summary
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 10:32 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T10:32:08.899041Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:45:41.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuto Hyakumoto"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027evf_toast_type\u0027 parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T09:25:34.908Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8a017198-daf1-4779-a101-dc539e263e50?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/assets/js/admin/admin.js#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/assets/js/admin/admin.js#L91"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/admin/class-evf-admin-assets.php#L376"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/assets/js/admin/admin.js"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T20:54:26.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-28T20:44:14.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.2 - Reflected Cross-Site Scripting via \u0027evf_toast_type\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91152",
"datePublished": "2026-10-29T09:25:34.908Z",
"dateReserved": "2026-09-14T20:39:22.523Z",
"dateUpdated": "2026-10-29T10:45:41.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96660 (GCVE-0-2026-96660)
Vulnerability from nvd – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:12
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
Summary
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:07 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.2.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:07:07.338872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:12:34.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kuba"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:43:28.389Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/690d23ee-cf70-4ecf-8cd2-21f673788d5f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/functions-ur-template.php#L555"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/frontend/class-ur-frontend-form-handler.php#L519"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-ajax.php#L221"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/functions-ur-core.php#L5606"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/frontend/class-ur-frontend-form-handler.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T15:04:33.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:40:38.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96660",
"datePublished": "2026-10-17T03:43:28.389Z",
"dateReserved": "2026-09-23T14:49:27.932Z",
"dateUpdated": "2026-10-18T11:12:34.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92978 (GCVE-0-2026-92978)
Vulnerability from nvd – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
Summary
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:08 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.2.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92978",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:08:17.533448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:46.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonah Burgess (CryptoCat)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core\u0027s own bulk-users nonce validation from executing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:43:29.067Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/713c4652-9ca0-41f7-9a93-8186d9b359e8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L687"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L667"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L140"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/admin/class-ur-admin-user-list-manager.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T13:57:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:40:54.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92978",
"datePublished": "2026-10-17T03:43:29.067Z",
"dateReserved": "2026-09-17T13:42:24.513Z",
"dateUpdated": "2026-10-18T11:22:46.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92798 (GCVE-0-2026-92798)
Vulnerability from nvd – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
Summary
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:07 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.2.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:07:46.822643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:46.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Passakorn Yookindee"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration \u0026 Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the \u0027referrer_url\u0027 branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() \u2014 which does not strip WordPress shortcode delimiters \u2014 before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:43:31.068Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L475"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L474"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/class-urcr-frontend.php#L1383"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/functions-urcr-core.php#L693"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-16T19:59:06.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:42:54.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via \u0027referrer_url\u0027 Smart Tag"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92798",
"datePublished": "2026-10-17T03:43:31.068Z",
"dateReserved": "2026-09-16T19:44:13.265Z",
"dateUpdated": "2026-10-18T11:22:46.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87111 (GCVE-0-2026-87111)
Vulnerability from nvd – Published: 2026-10-16 07:44 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
Summary
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPEverest | User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin |
Affected:
0 , ≤ 6.2.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:33:47.018837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:01.949Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration PRO \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin",
"vendor": "WPEverest",
"versions": [
{
"lessThanOrEqual": "6.2.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "andrea bocchetti"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration PRO \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T07:44:01.961Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/493ac933-f2b3-487b-8fc7-af2df9b0d460?source=cve"
},
{
"url": "https://wpuserregistration.com/changelog/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-09T13:53:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T19:40:05.000Z",
"value": "Disclosed"
}
],
"title": "User Registration PRO \u003c= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-87111",
"datePublished": "2026-10-16T07:44:01.961Z",
"dateReserved": "2026-09-08T20:33:53.846Z",
"dateUpdated": "2026-10-16T14:39:01.949Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15222 (GCVE-0-2026-15222)
Vulnerability from nvd – Published: 2026-10-16 06:41 – Updated: 2026-10-16 15:09
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
Summary
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:53 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.2.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:53:54.183390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:09:37.979Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hashiramasenju333"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:41:08.118Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f61873db-7365-41cb-a774-8f455a963d78?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-10T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-09T09:00:27.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T17:34:05.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15222",
"datePublished": "2026-10-16T06:41:08.118Z",
"dateReserved": "2026-07-09T08:43:58.506Z",
"dateUpdated": "2026-10-16T15:09:37.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74017 (GCVE-0-2026-74017)
Vulnerability from nvd – Published: 2026-09-17 13:24 – Updated: 2026-09-17 14:30
VLAI
EPSS
VEX
Title
WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:30 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration |
Affected:
n/a , ≤ 5.2.7
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:30:18.896664Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:30:41.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "user-registration",
"product": "User Registration",
"vendor": "wpeverest",
"versions": [
{
"changes": [
{
"at": "5.2.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.2.7",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "asdqgggg | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in User Registration \u003c= 5.2.7 versions."
}
],
"value": "Unauthenticated Broken Access Control in User Registration \u003c= 5.2.7 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T13:24:55.939Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-7-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress User Registration Plugin to the latest available version (at least 5.2.8)."
}
],
"value": "Update the WordPress User Registration Plugin to the latest available version (at least 5.2.8)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress User Registration plugin \u003c= 5.2.7 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-74017",
"datePublished": "2026-09-17T13:24:55.939Z",
"dateReserved": "2026-08-14T10:16:17.543Z",
"dateUpdated": "2026-09-17T14:30:41.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62103 (GCVE-0-2026-62103)
Vulnerability from nvd – Published: 2026-09-11 18:12 – Updated: 2026-09-11 20:19
VLAI
EPSS
VEX
Title
WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
Summary
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 20:09 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms |
Affected:
n/a , ≤ 3.6.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T20:09:31.579471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:19:11.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "everest-forms",
"product": "Everest Forms",
"vendor": "wpeverest",
"versions": [
{
"changes": [
{
"at": "3.6.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.6.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "LueRader | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated PHP Object Injection in Everest Forms \u003c= 3.6.0 versions."
}
],
"value": "Unauthenticated PHP Object Injection in Everest Forms \u003c= 3.6.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T18:12:03.157Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/everest-forms/vulnerability/wordpress-everest-forms-plugin-3-6-0-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Everest Forms Plugin to the latest available version (at least 3.6.1)."
}
],
"value": "Update the WordPress Everest Forms Plugin to the latest available version (at least 3.6.1)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Everest Forms plugin \u003c= 3.6.0 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-62103",
"datePublished": "2026-09-11T18:12:03.157Z",
"dateReserved": "2026-07-13T06:15:10.221Z",
"dateUpdated": "2026-09-11T20:19:11.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5096 (GCVE-0-2026-5096)
Vulnerability from nvd – Published: 2026-08-28 11:29 – Updated: 2026-08-28 18:35
VLAI
EPSS
VEX
Title
Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
Summary
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:18 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.4.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:18:07.308946Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:35:55.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0xilo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T11:29:29.094Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bbf7ed-c154-4153-adbf-59f0f7aa3a18?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/class-evf-form-task.php#L1448"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#L1196"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3507814/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-29T06:05:49.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field \u0027Previous Value\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5096",
"datePublished": "2026-08-28T11:29:29.094Z",
"dateReserved": "2026-03-29T05:50:23.592Z",
"dateUpdated": "2026-08-28T18:35:55.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74001 (GCVE-0-2026-74001)
Vulnerability from nvd – Published: 2026-08-20 12:07 – Updated: 2026-08-20 16:27
VLAI
EPSS
VEX
Title
WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
Summary
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 16:00 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPEverest | User Registration & Membership Pro |
Affected:
n/a , ≤ 5.4.5
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T16:00:24.503874Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:27:27.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership Pro",
"vendor": "WPEverest",
"versions": [
{
"changes": [
{
"at": "5.4.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.4.5",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "0xd4rk5id3 | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Authentication in User Registration \u0026 Membership Pro \u003c= 5.4.5 versions."
}
],
"value": "Unauthenticated Broken Authentication in User Registration \u0026 Membership Pro \u003c= 5.4.5 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T12:09:06.186Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/user-registration-pro/vulnerability/wordpress-user-registration-membership-pro-plugin-5-4-5-account-takeover-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress User Registration \u0026 Membership Pro Plugin to the latest available version (at least 5.4.6)."
}
],
"value": "Update the WordPress User Registration \u0026 Membership Pro Plugin to the latest available version (at least 5.4.6)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress User Registration \u0026 Membership Pro plugin \u003c= 5.4.5 - Account Takeover vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-74001",
"datePublished": "2026-08-20T12:07:22.716Z",
"dateReserved": "2026-08-14T10:15:59.205Z",
"dateUpdated": "2026-08-20T16:27:27.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115483 (GCVE-0-2026-115483)
Vulnerability from cvelistv5 – Published: 2026-11-10 19:31 – Updated: 2026-11-12 15:50
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
Summary
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check, without validating or restricting the path. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, such as wp-config.php, which can contain sensitive information. Successful exploitation requires a form whose email notification has the “Attach Files” setting enabled and that contains a field with a meta key matching /signature_/ (for example, a text field labelled “Signature”), with the notification routed to an attacker-supplied email address so the exfiltrated file is delivered to the attacker. Note: The Everest Forms Pro add-on is required to exploit this vulnerability, as it provides the signature field and the email file-attachment functionality (file-email-attachments) that the attack relies on.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 15:50 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
15 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T15:50:05.382869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T15:50:23.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Maciej Komorowski"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check, without validating or restricting the path. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, such as wp-config.php, which can contain sensitive information. Successful exploitation requires a form whose email notification has the \u201cAttach Files\u201d setting enabled and that contains a field with a meta key matching /signature_/ (for example, a text field labelled \u201cSignature\u201d), with the notification routed to an attacker-supplied email address so the exfiltrated file is delivered to the attacker. Note: The Everest Forms Pro add-on is required to exploit this vulnerability, as it provides the signature field and the email file-attachment functionality (file-email-attachments) that the attack relies on."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:31:31.738Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03f636e6-271d-4516-8db1-dc268ff794e7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1727"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1728"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1735"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1793"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1816"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1824"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1637"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1645"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/abstracts/class-evf-form-fields-upload.php#L1717"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/evf-entry-functions.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/evf-entry-functions.php#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/evf-core-functions.php#L1249"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.3/includes/class-evf-form-task.php#L1504"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3786305/everest-forms"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-22T15:28:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-10T06:49:17.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.3 - Unauthenticated Arbitrary File Read via \u0027Signature\u0027 Field Meta Key Branch of attach_entry_files"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-115483",
"datePublished": "2026-11-10T19:31:31.738Z",
"dateReserved": "2026-10-22T15:13:09.363Z",
"dateUpdated": "2026-11-12T15:50:23.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120513 (GCVE-0-2026-120513)
Vulnerability from cvelistv5 – Published: 2026-11-10 06:47 – Updated: 2026-11-12 18:03
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
Summary
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:37 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120513",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:37:41.741628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T18:03:49.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SAHRAOUI AYMEN"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the \u0027Disable storing entry information\u0027 setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T06:47:01.101Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d61468b-8fda-4775-8099-a34ddf34566b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/abstracts/class-evf-form-fields-upload.php#L1680"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/class-evf-form-task.php#L594"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/abstracts/class-evf-form-fields-upload.php#L1396"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/class-evf-ajax.php#L681"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3747723/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-09T16:32:12.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-09T18:20:39.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.2 - Unauthenticated Arbitrary File Deletion via \u0027everest_forms_{form_id}_old_{field_id}\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-120513",
"datePublished": "2026-11-10T06:47:01.101Z",
"dateReserved": "2026-11-02T16:12:49.399Z",
"dateUpdated": "2026-11-12T18:03:49.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89101 (GCVE-0-2026-89101)
Vulnerability from cvelistv5 – Published: 2026-11-06 11:17 – Updated: 2026-11-06 15:15
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
Summary
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 15:11 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89101",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:11:31.472742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:15:20.139Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Trgomez"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user \u2014 including personally identifiable information submitted through public contact and lead forms \u2014 regardless of form ownership."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T11:17:35.493Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fabe52a-b51e-4383-ac88-8f30e083c9bb?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L669"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L686"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L563"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L30"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L34"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L46"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-mcp-server.php#L52"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-registry.php#L74"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/includes/abilities/class-evf-abilities-handlers.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-10T21:48:37.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-05T22:19:09.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-89101",
"datePublished": "2026-11-06T11:17:35.493Z",
"dateReserved": "2026-09-10T21:48:21.571Z",
"dateUpdated": "2026-11-06T15:15:20.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27061 (GCVE-0-2026-27061)
Vulnerability from cvelistv5 – Published: 2026-10-30 18:30 – Updated: 2026-10-30 19:00
VLAI
EPSS
VEX
Title
WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
Summary
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:46 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration |
Affected:
n/a , ≤ 5.3.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T18:46:15.638931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:00:20.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "user-registration",
"product": "User Registration",
"vendor": "wpeverest",
"versions": [
{
"changes": [
{
"at": "5.3.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.3.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Filip Kowalski | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Subscriber Cross Site Scripting (XSS) in User Registration \u003c= 5.3.0 versions."
}
],
"value": "Subscriber Cross Site Scripting (XSS) in User Registration \u003c= 5.3.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:30:31.909Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to 5.3.1 or a higher version."
}
],
"value": "Update to 5.3.1 or a higher version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress User Registration plugin \u003c= 5.3.0 - Cross Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-27061",
"datePublished": "2026-10-30T18:30:31.909Z",
"dateReserved": "2026-02-17T13:23:42.766Z",
"dateUpdated": "2026-10-30T19:00:20.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91153 (GCVE-0-2026-91153)
Vulnerability from cvelistv5 – Published: 2026-10-29 09:25 – Updated: 2026-10-29 10:45
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
Summary
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 10:31 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T10:31:31.954808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:45:40.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "muhammad nizar"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values \u2014 including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type \u2014 via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T09:25:36.385Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b820a342-3aaa-4782-9d82-afe53028b72c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-smart-tags.php#L503"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-form-task.php#L731"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-form-task.php#L261"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-ajax.php#L681"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-ajax.php#L2342"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/shortcodes/class-evf-shortcode-form.php#L370"
},
{
"url": "https://github.com/themegrill/everest-forms/pull/1669/changes"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3747723/everest-forms/trunk/includes/class-evf-form-task.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T20:55:04.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-28T20:44:11.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91153",
"datePublished": "2026-10-29T09:25:36.385Z",
"dateReserved": "2026-09-14T20:40:00.677Z",
"dateUpdated": "2026-10-29T10:45:40.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91152 (GCVE-0-2026-91152)
Vulnerability from cvelistv5 – Published: 2026-10-29 09:25 – Updated: 2026-10-29 10:45
VLAI
EPSS
VEX
Title
Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
Summary
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 10:32 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.6.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T10:32:08.899041Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:45:41.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.6.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuto Hyakumoto"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027evf_toast_type\u0027 parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T09:25:34.908Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8a017198-daf1-4779-a101-dc539e263e50?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/assets/js/admin/admin.js#L22"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/assets/js/admin/admin.js#L91"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/admin/class-evf-admin-assets.php#L376"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/assets/js/admin/admin.js"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T20:54:26.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-28T20:44:14.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.6.2 - Reflected Cross-Site Scripting via \u0027evf_toast_type\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91152",
"datePublished": "2026-10-29T09:25:34.908Z",
"dateReserved": "2026-09-14T20:39:22.523Z",
"dateUpdated": "2026-10-29T10:45:41.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92798 (GCVE-0-2026-92798)
Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
Summary
The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:07 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.2.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:07:46.822643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:46.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Passakorn Yookindee"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration \u0026 Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the \u0027referrer_url\u0027 branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() \u2014 which does not strip WordPress shortcode delimiters \u2014 before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:43:31.068Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L475"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-smart-tags.php#L474"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/class-urcr-frontend.php#L1383"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/modules/content-restriction/functions-urcr-core.php#L693"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-16T19:59:06.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:42:54.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via \u0027referrer_url\u0027 Smart Tag"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92798",
"datePublished": "2026-10-17T03:43:31.068Z",
"dateReserved": "2026-09-16T19:44:13.265Z",
"dateUpdated": "2026-10-18T11:22:46.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92978 (GCVE-0-2026-92978)
Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
Summary
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:08 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.2.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92978",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:08:17.533448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:46.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonah Burgess (CryptoCat)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core\u0027s own bulk-users nonce validation from executing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:43:29.067Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/713c4652-9ca0-41f7-9a93-8186d9b359e8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L687"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L667"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L140"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/admin/class-ur-admin-user-list-manager.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/admin/class-ur-admin-user-list-manager.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-17T13:57:17.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:40:54.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92978",
"datePublished": "2026-10-17T03:43:29.067Z",
"dateReserved": "2026-09-17T13:42:24.513Z",
"dateUpdated": "2026-10-18T11:22:46.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96660 (GCVE-0-2026-96660)
Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:12
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
Summary
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:07 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.2.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:07:07.338872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:12:34.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kuba"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:43:28.389Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/690d23ee-cf70-4ecf-8cd2-21f673788d5f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/functions-ur-template.php#L555"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/frontend/class-ur-frontend-form-handler.php#L519"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/class-ur-ajax.php#L221"
},
{
"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.2.8/includes/functions-ur-core.php#L5606"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/frontend/class-ur-frontend-form-handler.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T15:04:33.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:40:38.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96660",
"datePublished": "2026-10-17T03:43:28.389Z",
"dateReserved": "2026-09-23T14:49:27.932Z",
"dateUpdated": "2026-10-18T11:12:34.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87111 (GCVE-0-2026-87111)
Vulnerability from cvelistv5 – Published: 2026-10-16 07:44 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
Summary
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPEverest | User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin |
Affected:
0 , ≤ 6.2.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:33:47.018837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:01.949Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration PRO \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin",
"vendor": "WPEverest",
"versions": [
{
"lessThanOrEqual": "6.2.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "andrea bocchetti"
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Registration PRO \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T07:44:01.961Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/493ac933-f2b3-487b-8fc7-af2df9b0d460?source=cve"
},
{
"url": "https://wpuserregistration.com/changelog/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-09T13:53:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T19:40:05.000Z",
"value": "Disclosed"
}
],
"title": "User Registration PRO \u003c= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-87111",
"datePublished": "2026-10-16T07:44:01.961Z",
"dateReserved": "2026-09-08T20:33:53.846Z",
"dateUpdated": "2026-10-16T14:39:01.949Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15222 (GCVE-0-2026-15222)
Vulnerability from cvelistv5 – Published: 2026-10-16 06:41 – Updated: 2026-10-16 15:09
VLAI
EPSS
VEX
Title
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
Summary
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:53 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder |
Affected:
0 , ≤ 5.2.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:53:54.183390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:09:37.979Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "5.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hashiramasenju333"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The User Registration \u0026 Membership \u2013 Free \u0026 Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration \u0026 Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:41:08.118Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f61873db-7365-41cb-a774-8f455a963d78?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3741339/user-registration/trunk/includes/class-ur-smart-tags.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-10T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-09T09:00:27.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T17:34:05.000Z",
"value": "Disclosed"
}
],
"title": "User Registration \u0026 Membership \u003c= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15222",
"datePublished": "2026-10-16T06:41:08.118Z",
"dateReserved": "2026-07-09T08:43:58.506Z",
"dateUpdated": "2026-10-16T15:09:37.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74017 (GCVE-0-2026-74017)
Vulnerability from cvelistv5 – Published: 2026-09-17 13:24 – Updated: 2026-09-17 14:30
VLAI
EPSS
VEX
Title
WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:30 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | User Registration |
Affected:
n/a , ≤ 5.2.7
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:30:18.896664Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:30:41.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "user-registration",
"product": "User Registration",
"vendor": "wpeverest",
"versions": [
{
"changes": [
{
"at": "5.2.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.2.7",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "asdqgggg | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in User Registration \u003c= 5.2.7 versions."
}
],
"value": "Unauthenticated Broken Access Control in User Registration \u003c= 5.2.7 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T13:24:55.939Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-2-7-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress User Registration Plugin to the latest available version (at least 5.2.8)."
}
],
"value": "Update the WordPress User Registration Plugin to the latest available version (at least 5.2.8)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress User Registration plugin \u003c= 5.2.7 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-74017",
"datePublished": "2026-09-17T13:24:55.939Z",
"dateReserved": "2026-08-14T10:16:17.543Z",
"dateUpdated": "2026-09-17T14:30:41.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62103 (GCVE-0-2026-62103)
Vulnerability from cvelistv5 – Published: 2026-09-11 18:12 – Updated: 2026-09-11 20:19
VLAI
EPSS
VEX
Title
WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
Summary
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 20:09 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms |
Affected:
n/a , ≤ 3.6.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T20:09:31.579471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:19:11.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "everest-forms",
"product": "Everest Forms",
"vendor": "wpeverest",
"versions": [
{
"changes": [
{
"at": "3.6.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.6.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "LueRader | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated PHP Object Injection in Everest Forms \u003c= 3.6.0 versions."
}
],
"value": "Unauthenticated PHP Object Injection in Everest Forms \u003c= 3.6.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T18:12:03.157Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/everest-forms/vulnerability/wordpress-everest-forms-plugin-3-6-0-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Everest Forms Plugin to the latest available version (at least 3.6.1)."
}
],
"value": "Update the WordPress Everest Forms Plugin to the latest available version (at least 3.6.1)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Everest Forms plugin \u003c= 3.6.0 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-62103",
"datePublished": "2026-09-11T18:12:03.157Z",
"dateReserved": "2026-07-13T06:15:10.221Z",
"dateUpdated": "2026-09-11T20:19:11.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5096 (GCVE-0-2026-5096)
Vulnerability from cvelistv5 – Published: 2026-08-28 11:29 – Updated: 2026-08-28 18:35
VLAI
EPSS
VEX
Title
Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
Summary
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:18 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI |
Affected:
0 , ≤ 3.4.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:18:07.308946Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:35:55.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI",
"vendor": "wpeverest",
"versions": [
{
"lessThanOrEqual": "3.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0xilo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T11:29:29.094Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bbf7ed-c154-4153-adbf-59f0f7aa3a18?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/class-evf-form-task.php#L1448"
},
{
"url": "https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#L1196"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3507814/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-29T06:05:49.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Everest Forms \u003c= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field \u0027Previous Value\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5096",
"datePublished": "2026-08-28T11:29:29.094Z",
"dateReserved": "2026-03-29T05:50:23.592Z",
"dateUpdated": "2026-08-28T18:35:55.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74001 (GCVE-0-2026-74001)
Vulnerability from cvelistv5 – Published: 2026-08-20 12:07 – Updated: 2026-08-20 16:27
VLAI
EPSS
VEX
Title
WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
Summary
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 16:00 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WPEverest | User Registration & Membership Pro |
Affected:
n/a , ≤ 5.4.5
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T16:00:24.503874Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:27:27.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "User Registration \u0026 Membership Pro",
"vendor": "WPEverest",
"versions": [
{
"changes": [
{
"at": "5.4.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.4.5",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "0xd4rk5id3 | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Authentication in User Registration \u0026 Membership Pro \u003c= 5.4.5 versions."
}
],
"value": "Unauthenticated Broken Authentication in User Registration \u0026 Membership Pro \u003c= 5.4.5 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T12:09:06.186Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/user-registration-pro/vulnerability/wordpress-user-registration-membership-pro-plugin-5-4-5-account-takeover-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress User Registration \u0026 Membership Pro Plugin to the latest available version (at least 5.4.6)."
}
],
"value": "Update the WordPress User Registration \u0026 Membership Pro Plugin to the latest available version (at least 5.4.6)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress User Registration \u0026 Membership Pro plugin \u003c= 5.4.5 - Account Takeover vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-74001",
"datePublished": "2026-08-20T12:07:22.716Z",
"dateReserved": "2026-08-14T10:15:59.205Z",
"dateUpdated": "2026-08-20T16:27:27.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}