CVE-2026-3601 is a medium severity vulnerability in the wpeverest User Registration & Membership WordPress plugin up to version 5.1.4. It involves a missing authorization check in the embed_form_action() function, allowing authenticated users with Contributor-level access or higher to append shortcode content to pages they do not own or have permission to edit. This vulnerability does not impact confidentiality or availability but allows unauthorized content modification. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through <= 5.1.5.
CVE-2026-5478 is a path traversal vulnerability in the Everest Forms WordPress plugin up to version 3.4.4. It allows unauthenticated attackers to read and delete arbitrary local files by injecting path traversal payloads into the old_files upload field parameter in public form submissions. This vulnerability arises because the plugin trusts attacker-controlled data and performs insecure path resolution without enforcing directory boundaries. Exploitation can lead to disclosure of sensitive files like wp-config.php, resulting in potential full site compromise, and deletion of critical files causing denial of service. The vulnerability requires the form to have a file-upload or image-upload field and disabled entry information storage. No official patch or remediation guidance is currently available.
The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed directly to WordPress's `wp_redirect()` function instead of the domain-restricted `wp_safe_redirect()`. While `esc_url_raw()` is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks.
CVE-2026-1865 is a medium severity SQL Injection vulnerability in the WordPress plugin 'User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder' up to version 5.1.2. The flaw exists in the 'membership_ids[]' parameter, which is insufficiently escaped, allowing authenticated users with Subscriber-level access or higher to inject additional SQL commands. This can lead to unauthorized extraction of sensitive database information. No official patch or remediation guidance is currently confirmed.
The Everest Forms WordPress plugin up to version 3.4.3 contains a critical vulnerability (CVE-2026-3296) involving PHP Object Injection via unsafe deserialization of untrusted input from form entry metadata. An unauthenticated attacker can inject a serialized PHP object payload through any public form field, which is stored in the database and later unserialized without class restrictions when an administrator views entries. This can lead to full system compromise due to the high severity of the vulnerability.
The Everest Forms Pro WordPress plugin up to version 1.9.12 contains a critical remote code execution vulnerability due to improper handling of user input in the Calculation Addon's process_filter() function. User-submitted form field values are concatenated into PHP code and evaluated without proper escaping, allowing unauthenticated attackers to inject and execute arbitrary PHP code via the "Complex Calculation" feature. This vulnerability has a CVSS score of 9.8, indicating a critical severity level. No official patch or remediation information is currently provided.
EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop (StopTransaction), the EVSE can return to `PrepareCharging` via the EV's BCB toggle, allowing session restart. This breaks the irreversibility of remote stop and can bypass operational/billing/safety controls. Version 2026.02.0 contains a patch.
EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorization response restores `authorized` back to true, defeating the `stop_transaction()` call condition on PowerOff events. As a result, the transaction can remain open even after a remote stop. Version 2026.02.0 contains a patch.
CVE-2026-33009 is a high-severity race condition vulnerability in the EVerest everest-core EV charging software stack versions prior to 2026.02.0. The issue arises from concurrent access to shared context objects without proper locking, triggered by a specific MQTT message. This can lead to undefined behavior and potential memory corruption. The vulnerability has been patched in version 2026.02.0.
EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines `transaction_active=false` and only calls `withdraw_authorization_callback`. This path ultimately calls `Charger::deauthorize()`, but no actual stop (StopTransaction) occurs in the Charging state. As a result, authorization withdrawal can be defeated by timing, allowing charging to continue. Version 2026.02.0 contains a patch.
CVE-2026-27828 is a use-after-free vulnerability in the EVerest everest-core EV charging software stack prior to version 2026.02.0. The issue occurs in the ISO15118_chargerImpl::handle_session_setup function, which uses a freed v2g_ctx object when ISO15118 initialization fails, such as when no IPv6 link-local address is present. An attacker with MQTT access can remotely crash the EVSE process by issuing a session_setup command under these conditions. The vulnerability has a medium severity with a CVSS score of 5.5. Version 2026.02.0 contains a patch that addresses this issue.
EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of length 6 without bounds checking. With schema validation disabled by default, oversized MQTT Cmd payloads can trigger out-of-bounds writes and corrupt adjacent EVSE state or crash the process. Version 2026.02.0 contains a patch.
CVE-2026-27815 is a medium severity vulnerability in the EVerest everest-core EV charging software stack prior to version 2026.02.0. It involves an out-of-bounds write caused by copying a variable-length payment_options list into a fixed-size array of length 2 without bounds checking. This occurs in the ISO15118_chargerImpl::handle_session_setup function. Since schema validation is disabled by default, oversized MQTT command payloads can trigger this vulnerability, potentially corrupting adjacent EVSE state or causing the process to crash. A patch addressing this issue is included in version 2026.02.0.
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch.
CVE-2026-27813 is a use-after-free vulnerability in the everest-core component of the EVerest EV charging software stack. Versions prior to 2026.02.0 are affected due to a data race condition triggered by EV plug-in/unplug events and authorization processes such as RFID, RemoteStart, or OCPP. This vulnerability has been patched in version 2026.02.0. The CVSS score is 5.3, indicating a medium severity level with potential impacts on confidentiality, integrity, and availability.
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map<std::queue>` corruption. The trigger is CSMS GetLog/UpdateFirmware request (network) with an EVSE fault event (physical). This results in TSAN reports concurrent access (data race) to `event_queue`. Version 2026.2.0 contains a patch.
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::queue`/`std::deque` corruption. The trigger is powermeter public key update and EV session/error events (while OCPP not started). This results in a TSAN data race report and an ASAN/UBSAN misaligned address runtime error being observed. Version 2026.02.0 contains a patch.
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map<std::optional>` concurrent access (container/optional corruption possible). The trigger is EV SoC update with powermeter periodic update and unplugging/SessionFinished status. Version 2026.02.0 patches the issue.