CVE-2026-23955 is a medium severity vulnerability in the EVerest EV charging software stack (everest-core) prior to version 2025.9.0. The flaw arises from improper string concatenation of integer values to literal strings when throwing errors, causing pointer arithmetic instead of expected integer printing. This behavior can be exploited by a malicious operator with high privileges and requiring user interaction to read unintended memory regions, including heap and stack areas, potentially exposing sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality. No known exploits are currently reported in the wild. The issue is fixed in version 2025.9.0.
CVE-2025-68137 is a high-severity buffer overflow vulnerability in the EVerest everest-core EV charging software stack. Prior to version 2025.10.0, an integer overflow in the SdpPacket::parse_header() function causes incorrect buffer length calculations, leading to either an infinite loop or a stack buffer overflow depending on the server configuration. This issue is fixed in version 2025.10.0.
CVE-2025-68136 is a high-severity vulnerability in the EVerest everest-core EV charging software stack versions prior to 2025.10.0. The flaw arises from improper resource management when handling SDP requests, where new session objects and TCP sockets are created without closing or destroying previous ones. This leads to resource exhaustion and potential null pointer dereferences, causing denial of service. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires network access but no authentication or user interaction, and the vulnerability has a CVSS score of 7.4. The issue was fixed in version 2025.10.
CVE-2025-68135 is a medium-severity vulnerability in the EVerest everest-core EV charging software stack prior to version 2025.10.0. It arises from improper handling of C++ exceptions in the TbdController loop, causing silent termination of the loop and its caller. This results in denial of service (DoS) conditions affecting the SDP and ISO15118-20 servers, which are critical for EV charging communication protocols. No known exploits are currently reported in the wild. The vulnerability does not impact confidentiality or integrity but severely affects availability. The issue is fixed in version 2025.10.0.
CVE-2025-68134 is a high-severity vulnerability in the EVerest everest-core EV charging software stack prior to version 2025.10.0. It stems from improper input validation where the use of the assert function causes module crashes. When any module crashes, the manager process shuts down all other modules and exits, leading to a denial of service (DoS) that affects multiple EVSE units and users. The vulnerability does not impact confidentiality or integrity but severely impacts availability. Exploitation requires no privileges or user interaction and can be performed remotely via network access. The issue is fixed in version 2025.10.0.
CVE-2025-68132 is an out-of-bounds read vulnerability in the EVerest everest-core EV charging software stack prior to version 2025.12.0. The flaw occurs in the DZG_GSH01 powermeter SLIP parser's is_message_crc_correct function, which reads bytes from a vector without verifying its size, leading to potential memory access violations. An attacker with control over the serial input can send malformed SLIP frames that cause the process to crash due to out-of-bounds reads and pop_back underflow. This vulnerability does not require authentication or user interaction and has a low CVSS score of 2.4, indicating limited impact. The issue is fixed in version 2025.12.0.
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.
The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'cities' parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.8. This is due to missing or incorrect nonce validation on the 'process_row_actions' function with the 'delete' action. This makes it possible for unauthenticated attackers to delete arbitrary post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the process_status_unlink() function in all versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to delete the back-up progress files and cause a back-up to fail while it is in progress.
The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a non-required signature form field along with an image upload field. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable in PHP versions prior to 8.
Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location.
The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, because a CiString<255> object is created with StringTooLarge set to Throw.
The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's urcr_restrict shortcode in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.