Advisories · Technology
wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI.
Every CVE that names wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Broken access control
- CVSS 5.3 Medium
Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Information disclosure
- CVSS 6.1 Medium
Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX…
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Broken access control
- CVSS 4.3 Medium
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Broken access control
- CVSS 8.1 High
Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Insecure deserialization
- CVSS 6.1 Medium
Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Unrestricted file upload
- CVSS 7.2 High
Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Server-side request forgery (SSRF)