Wpeverest
Wpeverest Everest Forms: vulnerabilidades y CVE
Wpeverest Everest Forms tiene 25 vulnerabilidades publicadas, 11 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE25
Últimos 12 meses11
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-62103 | Crítica (9.8) | 0.56% | — | 11 sept 2026 | Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. |
| CVE-2026-5096 | Media (5.3) | 0.41% | — | 28 ago 2026 | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php`… |
| CVE-2026-13167 | Media (4.3) | 0.47% | — | 16 ago 2026 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the… |
| CVE-2026-12270 | Media (6.5) | 0.30% | — | 9 jul 2026 | The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable… |
| CVE-2026-11571 | Alta (7.5) | 0.43% | — | 9 jul 2026 | The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing… |
| CVE-2026-57312 | Alta (7.1) | 0.25% | — | 26 jun 2026 | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. |
| CVE-2026-4888 | Media (4.3) | 0.26% | — | 28 may 2026 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function in… |
| CVE-2026-5478 | Alta (8.1) | 0.95% | — | 20 abr 2026 | The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files data from public… |
| CVE-2026-3296 | Crítica (9.8) | 3.0% | — | 8 abr 2026 | The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the… |
| CVE-2026-22422 | Media (5.3) | 0.23% | — | 19 feb 2026 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This issue affects Everest Forms: from n/a through <= 3.4.1. |
| CVE-2025-8871 | Media (5.6) | 0.28% | — | 5 nov 2025 | The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it… |
| CVE-2025-5927 | Alta (7.5) | 0.68% | — | 25 jun 2025 | The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.9.4. This makes… |
| CVE-2024-8542 | Media (4.8) | 0.35% | — | 15 may 2025 | The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2025-26841 | Media (6.1) | 0.28% | — | 12 may 2025 | Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload. |
| CVE-2025-3439 | Crítica (9.8) | 1.2% | — | 11 abr 2025 | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization… |
| CVE-2025-3422 | Media (6.3) | 0.32% | — | 11 abr 2025 | The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This… |
| CVE-2025-3421 | Media (6.1) | 0.35% | — | 11 abr 2025 | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and… |
| CVE-2025-1128 | Crítica (9.8) | 29% | — | 25 feb 2025 | The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path… |
| CVE-2024-13125 | Baja (3.5) | 0.34% | — | 13 feb 2025 | The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2024-10471 | Media (4.8) | 0.38% | — | 26 nov 2024 | The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2023-51377 | Media (5.3) | 0.31% | — | 14 jun 2024 | Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3. |
| CVE-2024-1812 | Alta (7.2) | 0.54% | — | 9 abr 2024 | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. This makes it possible for unauthenticated attackers to make… |
| CVE-2023-51695 | Media (4.8) | 0.34% | — | 1 feb 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! allows Stored… |
| CVE-2021-24907 | Media (6.1) | 0.91% | — | 21 dic 2021 | The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue |
| CVE-2019-13575 | Crítica (9.8) | 2.6% | — | 18 jul 2019 | A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.