What’s Vulnerable › Products

wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Cu vulnerabilities

31 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.

Check whether your wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Cu version is affected

Latest wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Cu vulnerabilities

• CVE-2026-27061 — WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-96660 — User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value (CVSS 7.2)
• CVE-2026-92978 — User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() (CVSS 4.3)
• CVE-2026-92798 — User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag (CVSS 8.1)
• CVE-2026-15222 — User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name (CVSS 5.4)
• CVE-2026-1869 — User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass (CVSS 6.5)
• CVE-2026-7651 — User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter (CVSS 5.3)
• CVE-2026-6145 — User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter (CVSS 5.3)
• CVE-2026-3601 — User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification (CVSS 4.3)
• CVE-2026-6203 — User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter (CVSS 6.1)
• CVE-2026-1865 — User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] (CVSS 6.5)
• CVE-2026-4056 — User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation (CVSS 5.4)
• CVE-2026-1492 — User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration (CVSS 9.8)
• CVE-2026-2356 — User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion (CVSS 5.3)
• CVE-2026-1779 — User Registration & Membership <= 5.1.2 - Authentication Bypass (CVSS 8.1)
• CVE-2025-14976 — User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion (CVSS 5.4)
• CVE-2025-13367 — User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
• CVE-2025-9085 — User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection (CVSS 4.9)
• CVE-2025-6831 — User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode (CVSS 6.4)
• CVE-2025-3281 — User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion (CVSS 5.3)
• CVE-2025-1511 — User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting (CVSS 6.1)
• CVE-2023-29429 — WordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2024-4958 — User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation (CVSS 7.1)
• CVE-2024-3295 — User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion (CVSS 6.5)
• CVE-2024-2417 — User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)