The User Registration & Membership plugin for WordPress versions up to and including 5.2.8 contains a code injection vulnerability. This arises from improper sanitization of the HTTP_REFERER header in the 'referrer_url' smart tag processing, allowing unauthenticated attackers to execute arbitrary registered shortcodes on restricted pages using the {{referrer_url}} tag. The vulnerability is classified as CWE-94 and has a high severity with a CVSS score of 8.1.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the wpeverest User Registration & Membership WordPress plugin versions up to and including 5.2.8. The flaw arises from missing or incorrect nonce validation in the trigger_bulk_action function, allowing unauthenticated attackers to trick administrators into approving or denying user registrations. This can result in locking targeted users out of the site. The vulnerability bypasses earlier nonce checks by exploiting an empty new_role parameter, leading to unprotected execution of bulk actions.
A stored cross-site scripting (XSS) vulnerability exists in the User Registration & Membership WordPress plugin up to version 5.2.8. The flaw allows unauthenticated attackers to inject malicious scripts via the Checkbox Field Value due to insufficient input sanitization and output escaping. The vulnerability is reachable through an AJAX action that lacks nonce validation, enabling arbitrary script execution when users access the injected content.
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
The User Registration & Membership plugin for WordPress up to version 5.2.8 contains a vulnerability that allows authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before passing it to the do_shortcode function, leading to potential code injection.
The Everest Forms WordPress plugin is vulnerable to a Server-Side Request Forgery (SSRF) issue in all versions up to and including 3.4.4. The vulnerability arises from the plugin's handling of upload fields, where arbitrary URLs from POST data are passed to a WordPress HTTP function without domain restrictions. This allows unauthenticated attackers to make the server perform outbound HTTP HEAD requests to arbitrary URLs by submitting a specially crafted form.
CVE-2026-74001 is a critical authentication bypass vulnerability in WPEverest User Registration & Membership Pro versions up to 5.4.5. It allows unauthenticated attackers to bypass authentication mechanisms using an alternate path or channel. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with delegated form management access and above, to activate arbitrary already-installed WordPress plugins — including previously deactivated or vulnerable plugins — without holding the core activate_plugins capability. Exploitation requires the target user to hold a delegated Everest Forms capability (manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms), which the plugin's own roles and permissions tool allows administrators to assign to non-administrator roles such as Author; the nonces required to exploit the AJAX handlers are emitted on EVF admin pages accessible to any such delegated user.
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.5. This is due to missing ownership validation on a user-controlled attachment ID, allowing the plugin to store and subsequently delete arbitrary media attachments without verifying that the referenced attachment belongs to the requesting user. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary media attachments uploaded by any other user, including administrators.
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function in all versions up to, and including, 3.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send test emails to arbitrary addresses from the server.
The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the is_admin_creation_process() method relying solely on the presence of action=createuser in the $_REQUEST superglobal without performing any authentication or capability check. This makes it possible for unauthenticated attackers to bypass the admin approval requirement when registering new accounts via the fallback submission path.
CVE-2026-3601 is a medium severity vulnerability in the wpeverest User Registration & Membership WordPress plugin up to version 5.1.4. It involves a missing authorization check in the embed_form_action() function, allowing authenticated users with Contributor-level access or higher to append shortcode content to pages they do not own or have permission to edit. This vulnerability does not impact confidentiality or availability but allows unauthorized content modification. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form.