CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

PT-2026-73083

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-66472

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-66472 WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-66472

CVE-2026-66472 affects the WordPress Everest Backup plugin up to version 2.3.12, with an unauthenticated SQL injection vulnerability reported. The connected sources confirm the affected product (Everest Backup plugin) and the vulnerability class (SQL injection) but do not provide technical detail...

EUVD-2026-57890

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-66472

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

PT-2026-71577

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by manop55555 in WordPress Plugin Everest Backup versions = 2.3.12...

CVE-2026-13158

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

EUVD-2026-51714

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

CVE-2026-13158

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

WordPress Everest Toolkit plugin <= 1.2.3 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin Everest Toolkit versions = 1.2.3...

CVE-2026-13158 Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

CVE-2026-13158

The Everest Toolkit WordPress plugin (versions 1.2.3) and implement proper upload handling (e.g., using WordPress wp_handle_upload with strict whitelisting) plus server rules to prevent PHP execution in uploads. If exploiting evidence exists, PoCs or in-wild links are mentioned within connected ...

CVE-2026-12270

The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or...

CVE-2026-11571

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via...

EUVD-2026-42508

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via...

CVE-2026-11571 Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via...

EUVD-2026-42511

The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or...