Skip to contentWpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder vulnerabilities
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_filesCVE-2026-1154837.5 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' ParameterCVE-2026-1205138.2 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC EndpointCVE-2026-891016.5 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})CVE-2026-911535.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' ParameterCVE-2026-911526.1 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'CVE-2026-50965.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX…CVE-2026-131674.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email SendingCVE-2026-48884.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' ParameterCVE-2026-54788.1 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry MetadataCVE-2026-32969.8 Critical
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionCVE-2025-34225.4 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.1.1 - Reflected Cross-Site ScriptingCVE-2025-34216.1 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object InjectionCVE-2025-34399.8 Critical
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and DeletionCVE-2025-1128EPSS 42.4%9.8 Critical
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_urlCVE-2024-18127.2 High