CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Cross-Site Scripting Almacenado No Autenticado Uso rápido root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Notas de explotación Gravedad: CRÍTICA CVSS: 9.8 Impacto: Confidencialidad, Integridad, Disponibilidad...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

CVE-2026-62103

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-62103

CVE-2026-62103 affects the WordPress Everest Forms plugin in versions 3.6.0 and earlier . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) by Patchstack, with high impact on confidentiality, integrity, and availability. No user interaction is required. A si...

EUVD-2026-76214

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

CVE-2026-62103 WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Everest Forms = 3.6.0 versions...

WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LueRader in WordPress Plugin Everest Forms versions = 3.6.0...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 es una vulnerabilidad crítica de inyección de objetos PHP no autenticada con CVSS 9.8 en el plugin Everest Forms de WordPress CVE-2026-3296 — Escáner de Inyección de Objetos PHP en Everest Forms Plugin: Everest Forms – Formulario de contacto, formulario de pago,...

CVE-2026-5096

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

WordPress Everest Forms plugin <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' vulnerability

Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' vulnerability discovered by h0xilo in WordPress Plugin Everest Forms versions = 3.4.4...

CVE-2026-5096 Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

CVE-2026-5096

The Everest Forms WordPress plugin (versions

EUVD-2026-67710

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The CVE concerns the Everest Forms WordPress plugin (Contact/Payment Form, Quiz, Survey & Custom Form Builder with AI) with authorization bypass in all versions up to 3.5.2. The root cause is inadequate verification of a user’s authorization to perform actions, enabling authenticated attackers wi...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-59862

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

PT-2026-73083

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...