Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41 results
Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Sensitive Information ExposureCVE-2026-91153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.
- Product
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Reflected Cross-Site ScriptingCVE-2026-91152 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
- Product
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Everest Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108491 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
- Product
- Everest Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.CVE-2026-39802 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
- Affected
- up to 2.3.13
- What to do
- Affects up to 2.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2026Everest Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.
- Product
- Everest Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.CVE-2026-62103 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026Everest Forms: Server-Side Request ForgeryCVE-2026-5096 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
- Product
- Everest Forms
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Authorization bypassCVE-2026-13167 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with delegated form management access and above, to activate arbitrary already-installed WordPress plugins — including previously deactivated or vulnerable plugins — without holding the core activate_plugins capability. Exploitation requires the target user to hold a delegated Everest Forms capability (manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms), which the plugin's own roles and permissions tool allows administrators to assign to non-administrator roles such as Author; the nonces required to exploit the AJAX handlers are emitted on EVF admin pages accessible to any such delegated user.
- Product
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.CVE-2026-66472 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.
- Affected
- up to 2.3.12
- What to do
- Affects up to 2.3.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026Everest Toolkit: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13158 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
- Product
- Everest Toolkit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Everest Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2026Everest Forms: Does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only appliedCVE-2026-12270 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header. This makes it possible for unauthenticated attackers to read onboarding status information, modify the related Everest Forms WordPress plugin before 3.5.0 options, and trigger an email from the site to an arbitrary address.
- Product
- Everest Forms
- Fixed in
- 3.5.0
- What to do
- Update Everest Forms to 3.5.0 or newer.
Jul 9, 2026Everest Forms: Does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directoryCVE-2026-11571 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.
- Product
- Everest Forms
- Fixed in
- 3.5.0
- What to do
- Update Everest Forms to 3.5.0 or newer.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.CVE-2026-57312 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.
- What to do
- Update the plugin to the newest version.
May 27, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder: Unauthorized email sendingCVE-2026-4888 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function in all versions up to, and including, 3.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send test emails to arbitrary addresses from the server.
- Product
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- Affected
- up to 3.4.7
- What to do
- Affects up to 3.4.7. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 20, 2026Everest Forms: Arbitrary File Read and DeletionCVE-2026-5478 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files data from public form submissions as legitimate server-side upload state, and converting attacker-supplied URLs into local filesystem paths using regex-based string replacement without canonicalization or directory boundary enforcement. This makes it possible for unauthenticated attackers to read arbitrary local files (e.g., wp-config.php) by injecting path-traversal payloads into the old_files upload field parameter, which are then attached to notification emails. The same path resolution is also used in the post-email cleanup routine, which calls unlink() on the resolved path, resulting in the targeted file being deleted after being attached. This can lead to full site compromise through disclosure of database credentials and authentication salts from wp-config.php, and denial of service through deletion of critical files. Prerequisite: The form must contain a file-upload or image-upload field, and disable storing entry information.
- Product
- Everest Forms
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Everest Forms: PHP Object InjectionCVE-2026-3296 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.
- Product
- Everest Forms
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 30, 2026Everest Forms Pro: Remote Code ExecutionCVE-2026-3300 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.
- Product
- Everest Forms Pro
- Affected
- up to 1.9.12
- What to do
- Affects up to 1.9.12. Update Everest Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordeverestforms.netplugins.trac.wordpress.org
Mar 19, 2026Everest Forms Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27070 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms Pro allows Stored XSS.This issue affects Everest Forms Pro: from n/a through 1.9.10.
- Product
- Everest Forms Pro
- Affected
- up to 1.9.10
- What to do
- Affects up to 1.9.10. Update Everest Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Everest Forms: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-22422 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This issue affects Everest Forms: from n/a through <= 3.4.1.
- Product
- Everest Forms
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Everest Backup: Cross-Site Request Forgery (CSRF)CVE-2025-62992 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Path Traversal.This issue affects Everest Backup: from n/a through <= 2.3.11.
- Product
- Everest Backup
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2025Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Unauthorized accessCVE-2025-10304 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the process_status_unlink() function in all versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to delete the back-up progress files and cause a back-up to fail while it is in progress.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 4, 2025Everest Forms (Pro): PHP Object InjectionCVE-2025-8871 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a non-required signature form field along with an image upload field. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable in PHP versions prior to 8.
- Product
- Everest Forms (Pro)
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update Everest Forms (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordeverestforms.networdfence.com
Oct 26, 2025Everest Backup: Missing AuthorizationCVE-2025-62946 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.
- Product
- Everest Backup
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Everest Forms - Frontend Listing: Deserialization of Untrusted DataCVE-2025-60210 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.
- Product
- Everest Forms - Frontend Listing
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Everest Forms - Frontend Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2025Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Unauthorized access of dataCVE-2025-11380 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 25, 2025Everest Forms (Pro): Arbitrary file deletionCVE-2025-5927 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability requires an admin to trigger the deletion via deletion of a form entry and cannot be carried out by the attacker alone.
- Product
- Everest Forms (Pro)
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update Everest Forms (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordeverestforms.networdpress.org
Jun 6, 2025Everest Backup: Cross-Site Request Forgery (CSRF)CVE-2025-49238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Backup: from n/a through <= 2.3.3.
- Product
- Everest Backup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-8542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.3.1
- What to do
- Update Everest Forms to 3.0.3.1 or newer.
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: PHP Object InjectionCVE-2025-3439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input from the 'field_value' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 11, 2025The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary shortcode executionCVE-2025-3422 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Reflected Cross-Site ScriptingCVE-2025-3421 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 25, 2025Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary file upload, read, and deletionCVE-2025-1128 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
- Product
- Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.0.9.4
- What to do
- Affects up to 3.0.9.4. Update Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-13125 · WordPress plugins & themes · reported by WPScanLow 3.5
The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.8.1
- What to do
- Update Everest Forms to 3.0.8.1 or newer.
Nov 26, 2024Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-10471 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.4.2
- What to do
- Update Everest Forms to 3.0.4.2 or newer.
Nov 5, 2024Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Sensitive Information ExposureCVE-2024-10028 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.13 via the exposed process stats file during the backup process. This makes it possible for unauthenticated attackers to obtain an archive file name and download the site's backup.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 14, 2024Everest Forms: Missing AuthorizationCVE-2023-51377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3.
- Product
- Everest Forms
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2024Everest Backup: Does not properly validate backup files to be uploadedCVE-2023-7201 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- Everest Backup
- Fixed in
- 2.2.5
- What to do
- Update Everest Backup to 2.2.5 or newer.
Apr 9, 2024Everest Forms: Server-Side Request ForgeryCVE-2024-1812 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Everest Forms
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2024Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51695 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! allows Stored XSS.This issue affects Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: from n/a through 2.0.4.1.
- Product
- Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!
- Affected
- up to 2.0.4.1
- What to do
- Affects up to 2.0.4.1. Update Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 31, 2023Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52185 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin.This issue affects Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: from n/a through 2.1.9.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 18, 2019A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9.CVE-2019-13575 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfortiguard.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.