User Registration

wpeverest

Developer

5.2.1

Latest version

60,000

Installations

No date

Last updated

WordPress Plugin

Active VDP

Report vulnerability

Vulnerabilities

Security Policy

Security Contributors

Vulnerability history

0 present

37 patched

15 Mitigation rules

Broken Access Control vulnerability
<= 5.1.2
3 days ago
Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion vulnerability
<= 5.1.5
4 days ago
Unauthenticated Missing Authorization to Admin Approval Bypass vulnerability
<= 5.1.5
13/05/2026
Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification vulnerability
<= 5.1.4
04/05/2026
Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter vulnerability
<= 5.1.4
14/04/2026
Authenticated (Subscriber+) SQL Injection via membership_ids[] vulnerability
<= 5.1.2
10/04/2026
Cross Site Scripting (XSS) vulnerability
<= 5.1.5
09/04/2026
Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation vulnerability
<= 5.1.4
24/03/2026
Privilege Escalation vulnerability
<= 4.4.9
23/03/2026
Unauthenticated Privilege Escalation via Membership Registration vulnerability
<= 5.1.2
03/03/2026
Authentication Bypass vulnerability
<= 5.1.2
26/02/2026
Insecure Direct Object Reference to Unauthenticated Limited User Deletion vulnerability
<= 5.1.2
25/02/2026
Broken Access Control vulnerability
<= 4.4.6
21/01/2026
Cross-Site Request Forgery to Arbitrary Post Deletion vulnerability
<= 4.4.8
09/01/2026
Arbitrary Shortcode Execution vulnerability
<= 4.4.9
08/01/2026
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability
<= 4.4.6
15/12/2025
Authenticated (Admin+) SQL Injection vulnerability
<= 4.3.0
05/09/2025
Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode vulnerability
<= 4.2.4
21/07/2025
Insecure Direct Object Reference to Unauthenticated Limited User Deletion vulnerability
<= 4.2.1
05/05/2025
Reflected Cross Site Scripting (XSS) vulnerability
< 4.2.0
22/04/2025
Insecure Direct Object Reference to Unauthenticated Membership Modification vulnerability
<= 4.1.3
11/04/2025
Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update vulnerability
<= 4.1.3
11/04/2025
Authentication Bypass vulnerability
< 4.1.3
01/04/2025
Cross Site Scripting (XSS) vulnerability
<= 4.0.3
27/03/2025
Unauthenticated Privilege Escalation vulnerability
< 4.1.2
25/03/2025
Reflected Cross-Site Scripting vulnerability
<= 4.0.4
28/02/2025
Missing Authorization to Privilege Escalation vulnerability
<= 3.2.0.1
03/06/2024
Authenticated (Subscriber+) Privilege Escalation vulnerability
<= 3.1.5
19/04/2024
Missing Authorization to Unauthenticated Media Deletion vulnerability
<= 3.1.5
16/04/2024
Unauthenticated Stored Self-Based Cross-Site Scripting vulnerability
<= 3.1.4
07/03/2024
Admin+ Stored XSS vulnerability
< 3.0.4.2
07/11/2023
Authenticated Arbitrary File Upload vulnerability
<= 3.0.2
04/07/2023
Broken Access Control vulnerability
<= 2.3.2.1
06/04/2023
Authenticated PHP Object Injection vulnerability
<= 2.3.2.1
21/03/2023
Cross Site Scripting (XSS)
<= 2.3.0
20/01/2023
Stored Cross-Site Scripting (XSS) vulnerability
<= 2.0.1
06/09/2021
Reflected Cross-Site Scripting (XSS) vulnerability
<= 1.5.5
14/01/2019