900 matches found
Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...
Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...
everest-backup-cve-2025-11380
CVE-2025-11380 Proof of concept code for CVE-2025-11380 - unauthenticated backup access in Everest Backup WordPress plugin. Blog post link coming soon...
CVE-2026-3296
CVE-2026-3296 CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Plugin: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Plugin Slug...
CVE-2026-13158
CVE-2026-13158: Everest Toolkit = 1.2.3 — Admin+ Arbitrary File Upload to Remote Code Execution RCE 📖 Advisory Overview CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and...
CVE-2022-39959
CVE-2022-39959 Affected Vendor- Panini https://www.panini.com/en Affected Product - Panini Everest Engine Affected Version - 2.0.4 There is an Unquoted Service Path in Everest EngineEverestEngine.exe in version 2.0.4 on Windows. This allows an unauthorized local user to insert arbitrary code into...
CVE-2026-3300
CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-31 Technical...
CVE-2026-108491
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...
CVE-2026-108491
The Everest Forms WordPress plugin (versions
CVE-2026-108491 WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...
EUVD-2026-102006
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...
CVE-2026-108491 WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...
PT-2026-114899
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...
CVE-2026-108491: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Everest Forms versions = 3.6.1...
CVE-2026-39802
Unauthenticated Remote Code Execution RCE in Everest Backup = 2.3.13 versions...
CVE-2026-39802 WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in Everest Backup = 2.3.13 versions...
EUVD-2026-96535
Unauthenticated Remote Code Execution RCE in Everest Backup = 2.3.13 versions...