Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

CVE-2026-62103

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-62103

CVE-2026-62103 affects the WordPress Everest Forms plugin in versions 3.6.0 and earlier . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) by Patchstack, with high impact on confidentiality, integrity, and availability. No user interaction is required. A si...

EUVD-2026-76214

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-62103 WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit 빠른 링크: DEV.to 글에서 전체 심층 기술 권고를 읽거나 연구원의 공식 사이버보안 포트폴리오를 확인하세요. 📌 요약 및 기술 메타데이터 🔍 근본 원인 분석 CVE-2026-13158의 근본 원인은 EverestToolkit 관리자 핸들러 클래스 내의 안전하지 않은 파일 업로드 처리에서 비롯됩니다. 인증된 관리자 또는 관리 권한을 가진 사용자가 파일 업로드 엔드포인트예: 템플릿 가져오기, 사용자 지정 아이콘 업로드, 자산 구성 루틴를 호출할 때, 플러그인은 실행 가능...

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Неаутентифицированное сохраненное межсайтовое выполнение сценариев XSS Быстрое использование root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Примечания по эксплуатации Серьезность: КРИТИЧЕСКИЙ CVSS: 9.8 Воздействие:...

everest-backup-cve-2025-11380

CVE-2025-11380 Код доказательства концепции для CVE-2025-11380 - неаутентифицированный доступ к резервным копиям в плагине Everest Backup для WordPress. Ссылка на пост в блоге скоро появится...

CVE-2022-39959

CVE-2022-39959 영향을 받는 공급업체 - Panini https://www.panini.com/en 영향을 받는 제품 - Panini Everest Engine 영향을 받는 버전 - 2.0.4 Windows에서 버전 2.0.4 의 Everest EngineEverestEngine.exe에 따옴표 없는 서비스 경로Unquoted Service Path 취약점이 존재합니다. 이로 인해 권한이 없는 로컬 사용자가 따옴표 없는 서비스 경로에 임의의 코드를 삽입하고 시스템 권한으로 권한을 상승시킬 수 있습니다. 파일 경로:...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 — это критическая уязвимость PHP Object Injection с рейтингом CVSS 9.8 без аутентификации в плагине WordPress Everest Forms CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Плагин: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder...

CVE-2026-5096

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

WordPress Everest Forms plugin <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' vulnerability

Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' vulnerability discovered by h0xilo in WordPress Plugin Everest Forms versions = 3.4.4...

CVE-2026-5096 Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

CVE-2026-5096

The Everest Forms WordPress plugin (versions

EUVD-2026-67710

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The CVE concerns the Everest Forms WordPress plugin (Contact/Payment Form, Quiz, Survey & Custom Form Builder with AI) with authorization bypass in all versions up to 3.5.2. The root cause is inadequate verification of a user’s authorization to perform actions, enabling authenticated attackers wi...

EUVD-2026-59862

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...