CVE-2026-125853

Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15...

CVE-2026-125853

The Everest Backup WordPress plugin (versions up to and including 2.3.15 ) is susceptible to a Missing Authorization vulnerability. This flaw allows for the exploitation of Incorrectly Configured Access Control security levels, specifically identified as a Broken Access Control issue. The vulnera...

EUVD-2026-125408

Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15...

CVE-2026-125853 WordPress Everest Backup plugin <= 2.3.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15...

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-31 Technical...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

CVE-2022-39959

CVE-2022-39959 Affected Vendor- Panini https://www.panini.com/en Affected Product - Panini Everest Engine Affected Version - 2.0.4 There is an Unquoted Service Path in Everest EngineEverestEngine.exe in version 2.0.4 on Windows. This allows an unauthorized local user to insert arbitrary code into...

everest-backup-cve-2025-11380

CVE-2025-11380 Proof of concept code for CVE-2025-11380 - unauthenticated backup access in Everest Backup WordPress plugin. Blog post link coming soon...

WordPress Everest Backup plugin <= 2.3.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by b3llj0n in WordPress Plugin Everest Backup versions = 2.3.15...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit = 1.2.3 — Admin+ Arbitrary File Upload to Remote Code Execution RCE 📖 Advisory Overview CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and...

CVE-2026-115483

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attachentryfiles function. This is due to the function attaching any entry field value whose meta key matches /signature/ to the notification email after only a fileexis...

EUVD-2026-122685

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attachentryfiles function. This is due to the function attaching any entry field value whose meta key matches /signature/ to the notification email after only a fileexis...

CVE-2026-115483

The Everest Forms plugin for WordPress (versions up to and including 3.6.3 ) is vulnerable to an Unauthenticated Arbitrary File Read via the attach_entry_files() function. The root cause is that the function attaches any entry field value whose meta key matches /signature_/ to notification emails...

CVE-2026-115483 Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attachentryfiles function. This is due to the function attaching any entry field value whose meta key matches /signature/ to the notification email after only a fileexis...

WordPress Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.6.3 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Maciej Komorowski in WordPress Plugin Everest Forms versions = 3.6.3...

WordPress Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by SAHRAOUI AYMEN in WordPress Plugin Everest Forms versions = 3.6.2...

CVE-2026-120513

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

CVE-2026-120513

The Everest Forms WordPress plugin (versions up to and including 3.6.2 ) is vulnerable to unauthenticated arbitrary file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function. Attackers can delete files within the wp-content/uploads directory, potentia...

EUVD-2026-120824

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...