wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder version is affected

Latest wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder vulnerabilities

CVE-2026-62103 — WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability (CVSS 9.8)
CVE-2026-12270 — Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints (CVSS 6.5)
CVE-2026-11571 — Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts (CVSS 7.5)
CVE-2026-57312 — WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2026-4888 — Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending (CVSS 4.3)
CVE-2026-5478 — Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter (CVSS 8.1)
CVE-2026-3296 — Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata (CVSS 9.8)
CVE-2026-3300 — Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field (CVSS 9.8)
CVE-2026-27070 — WordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2026-22422 — WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3)
CVE-2025-8871 — Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature (CVSS 5.6)
CVE-2025-5927 — Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion (CVSS 7.5)
CVE-2024-8542 — Everest Forms < 3.0.3.1 - Admin+ Stored XSS (CVSS 4.8)
CVE-2025-26841 — (CVSS 6.1)
CVE-2025-3439 — Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection (CVSS 9.8)
CVE-2025-3422 — Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 6.3)
CVE-2025-3421 — Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting (CVSS 6.1)
CVE-2025-1128 — Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion (CVSS 9.8)
CVE-2024-13125 — Everest Forms < 3.0.8.1 - Admin+ Stored XSS (CVSS 3.5)
CVE-2024-10471 — Everest Forms < 3.0.4.2 - Admin+ Stored XSS (CVSS 4.8)
CVE-2023-51377 — WordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerability (CVSS 5.3)
CVE-2024-1812 — Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url (CVSS 7.2)
CVE-2023-51695 — WordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)
CVE-2021-24907 — Everest Forms < 1.8.0 - Reflected Cross-Site Scripting (CVSS 6.1)
CVE-2019-13575 — (CVSS 9.8)