47
CVEs
8
Critical
11
High
0
KEV
13
PoC
13
Unpatched C/H
25.5%
Patch Rate
2.7%
Avg EPSS
Severity Breakdown
CRITICAL
8
HIGH
11
MEDIUM
27
LOW
1
Monthly CVE Trend
Affected Products (12)
Wordpress Plugin
35
PHP
17
Everest Forms
14
User Registration
12
User Registration Membership
8
User Registration Membership Free Paid Memberships Subscriptions Content Restriction User Profile Custom User Registration Login Builder
6
Everest Forms Contact Form Payment Form Quiz Survey Custom Form Builder
2
Everest Forms Contact Form Payment Form Quiz Survey Custom Form Builder With Ai
2
Open Redirect
1
Everest Forms Pro
1
User Registration Membership Pro
1
Pdfdraft Drag Drop Pdf Builder Pdf Viewer Embed Download Pdf Certificate Invoice Designer
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-2563 | The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls. | HIGH | 8.1 | 83.9% | 159 |
PoC
No patch
|
| CVE-2023-3342 | The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | CRITICAL | 9.9 | 6.4% | 76 |
PoC
|
| CVE-2026-3300 | Remote code execution in Everest Forms Pro plugin for WordPress ≤1.9.12 allows unauthenticated attackers to execute arbitrary PHP code on the server via the Complex Calculation feature. Attackers can inject malicious PHP through any string-type form field (text, email, URL, select, radio) due to unsafe concatenation into eval() without proper escaping. This vulnerability carries a 9.8 CVSS score with maximum impact (confidentiality, integrity, availability) and requires no authentication or user interaction, representing a critical immediate threat to all installations using the affected plugin versions. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2026-3296 | PHP object injection in Everest Forms for WordPress (all versions ≤3.4.3) allows unauthenticated remote attackers to achieve critical system compromise. Attackers submit malicious serialized payloads through any public form field, which persist through sanitization into the wp_evf_entrymeta database table. When administrators view form entries, unsafe unserialize() without class restrictions processes the payload, enabling arbitrary code execution. CVSS 9.8 (Critical) reflects network-accessible | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2025-2594 | The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available. | HIGH | 8.1 | 7.4% | 68 |
PoC
No patch
|
| CVE-2022-3912 | The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.7% | 58 |
PoC
No patch
|
| CVE-2025-1128 | The Everest Forms - Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server. | CRITICAL | 9.8 | 7.4% | 56 |
|
| CVE-2025-3439 | The Everest Forms - Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects. | CRITICAL | 9.8 | 4.5% | 53 |
|
| CVE-2026-6203 | Open redirect in the WPEverest User Registration & Membership WordPress plugin (versions ≤5.1.4) enables attackers to abuse the logout flow as a phishing vector by supplying an arbitrary external URL via the `redirect_to_on_logout` GET parameter. The plugin passes this parameter directly to WordPress's unrestricted `wp_redirect()` instead of the domain-enforcing `wp_safe_redirect()`, and the `esc_url_raw()` sanitization applied only strips malformed URL syntax - it imposes no domain allowlist. A publicly available POC demonstrates the redirect behavior; however, EPSS is very low (0.03%, 7th percentile) and CISA SSVC rates exploitation as 'none' with non-automatable impact, indicating no observed mass exploitation at time of analysis. | MEDIUM | 6.1 | 0.0% | 51 |
PoC
No patch
|
| CVE-2021-24907 | The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.9% | 50 |
PoC
No patch
|
| CVE-2019-13575 | A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | CRITICAL | 9.8 | 2.6% | 49 |
|
| CVE-2026-74001 | Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-62103 | Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2021-24654 | The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.4 | 0.6% | 47 |
PoC
No patch
|
| CVE-2023-3343 | The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects. | HIGH | 8.8 | 0.6% | 45 |
|