WordPress plugin
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical4
- High6
- Medium21
- Low0
All Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerabilities
- High7.5Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
≤3.6.3No patch available
- High8.2Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
≤3.6.2Update to 3.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.6.3Update to 3.6.4
- Medium4.3Missing Authorization
≤3.6.3Update to 3.6.4
- Medium6.5Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
≤3.6.2Update to 3.6.3
- Medium6.1Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
≤3.6.2Update to 3.6.3
- Medium5.3Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
≤3.6.2Update to 3.6.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.1Update to 3.6.2
- Medium6.1Reflected Cross-Site Scripting
≤3.6.1Update to 3.6.2
- High8.1Unauthenticated PHP Object Injection
≤3.6.0Update to 3.6.1
- Medium5.3Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
≤3.4.4Update to 3.4.5
- Medium4.3Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints
≤3.5.2Update to 3.5.3
- Medium6.1Reflected Cross-Site Scripting
≤3.4.8Update to 3.5.0
- Medium5.3Unauthenticated Missing Authorization
≤3.4.0Update to 3.5.0
- Medium5.3Unauthenticated Information Exposure
≤3.4.0Update to 3.5.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Email Sending
≤3.4.7Update to 3.4.8
- High8.1Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter
≤3.4.4Update to 3.4.5
- Critical9.8Unauthenticated PHP Object Injection via Form Entry Metadata
≤3.4.3Update to 3.4.4
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤3.4.1Update to 3.4.2
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤3.1.1Update to 3.1.2
- Critical9.8Unauthenticated PHP Object Injection
≤3.1.1Update to 3.1.2
- Medium6.1Reflected Cross-Site Scripting
≤3.1.1Update to 3.1.2
- Critical9.8Unauthenticated Arbitrary File Upload, Read, and Deletion
≤3.0.9.4Update to 3.0.9.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.0.8Update to 3.0.8.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.0.4.1Update to 3.0.4.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.0.3Update to 3.0.3.1
- High7.2Unauthenticated Server-Side Request Forgery via font_url
≤2.0.7Update to 2.0.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.0.4.1Update to 2.0.5
- Medium5.3Unauthorized Form Submission via Disabled Forms
≤2.0.3Update to 2.0.3.1
- Medium6.1Reflected Cross-Site Scripting
<1.8.0Update to 1.8.0
- Critical9.8SQL Injection
<1.5.0Update to 1.5.0
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: common questions
Does Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI have known vulnerabilities?
Yes. VulnCrest Radar lists 31 known vulnerabilities in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: 4 critical, 6 high, 21 medium. At least one is not fixed in the latest version.
How do I check which version of Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerability?
CVE-2026-115483, published Nov 10, 2026: Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files. Severity: High (CVSS 7.5).
Is any Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerability listed in CISA KEV?
No. None of the known Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerabilities is currently listed in the CISA KEV catalog.