Skip to contentWpeverest Everest Forms vulnerabilities
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_filesCVE-2026-1154837.5 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' ParameterCVE-2026-1205138.2 High
- everest forms forms, wpeverest everest forms +1 moreWordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1226696.5 Medium
- everest forms forms, wpeverest everest forms +1 moreWordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerabilityCVE-2026-1208374.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC EndpointCVE-2026-891016.5 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})CVE-2026-911535.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' ParameterCVE-2026-911526.1 Medium
- everest forms forms, wpeverest everest forms +1 moreWordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1084917.1 High
- everest forms forms, wpeverest everest forms +1 moreWordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-946707.1 High
- wpeverest everest formsWordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerabilityCVE-2026-621039.8 Critical
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'CVE-2026-50965.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX…CVE-2026-131674.3 Medium
- unknown everest formsEverest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST EndpointsCVE-2026-122706.5 Medium
- unknown everest formsEverest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV ArtifactsCVE-2026-115717.5 High
- wpeverest everest formsWordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-573127.1 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email SendingCVE-2026-48884.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' ParameterCVE-2026-54788.1 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry MetadataCVE-2026-32969.8 Critical
- wpeverest everest forms proEverest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation FieldCVE-2026-3300Public exploitEPSS 39.2%9.8 Critical
- wpeverest everest forms proWordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-270707.1 High
- wpeverest everest formsWordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerabilityCVE-2026-224225.3 Medium
- wpeverest everest forms proEverest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form SignatureCVE-2025-88715.6 Medium
- wpeverest everest forms - frontend listing, everest forms frontend listing +1 moreWordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection VulnerabilityCVE-2025-602109.8 Critical
- wpeverest everest forms, everest forms pro +1 moreEverest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File DeletionCVE-2025-59277.5 High
- unknown everest formsEverest Forms < 3.0.3.1 - Admin+ Stored XSSCVE-2024-85424.8 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionCVE-2025-34225.4 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.1.1 - Reflected Cross-Site ScriptingCVE-2025-34216.1 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object InjectionCVE-2025-34399.8 Critical
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and DeletionCVE-2025-1128EPSS 42.4%9.8 Critical
- unknown everest formsEverest Forms < 3.0.8.1 - Admin+ Stored XSSCVE-2024-131253.5 Low
- unknown everest formsEverest Forms < 3.0.4.2 - Admin+ Stored XSSCVE-2024-104714.8 Medium
- wpeverest everest formsWordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerabilityCVE-2023-513775.3 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_urlCVE-2024-18127.2 High
- wpeverest everest forms – build contact forms, surveys, polls, application forms, and more with ease!, everest forms +1 moreWordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS)CVE-2023-516955.9 Medium