Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

Information

Software Type Plugin
Software Slug everest-forms (view on wordpress.org)
Software Status Active
Software Author wpeverest
Software Website everestforms.net
Software Downloads 7,788,799
Software Active Installs 90,000
Software Record Last Updated August 19, 2026

18 Vulnerabilities

Submit a Vulnerability
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints
4.3
CVE-2026-13167
Aug 15, 2026
Researcher: skyv3il
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.4.8 - Reflected Cross-Site Scripting
6.1
CVE-2026-57312
Jun 25, 2026
Researcher: bekitousei
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending
4.3
CVE-2026-4888
May 27, 2026
Researcher: Quốc Huy (jtwings)
Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter
8.1
CVE-2026-5478
Apr 20, 2026
Researcher: Bao Le
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
9.8
CVE-2026-3296
Apr 7, 2026
Researcher: 0xsabre
Everest Forms <= 3.4.1 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVE-2026-22422
Sep 26, 2025
Researcher: Najib Sinjari
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection
9.8
CVE-2025-3439
Apr 10, 2025
Researcher: kuaile
Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting
6.1
CVE-2025-3421
Apr 10, 2025
Researcher: mikemyers
Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
5.4
CVE-2025-3422
Apr 10, 2025
Researcher: mikemyers
Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion
9.8
CVE-2025-1128
Feb 17, 2025
Researcher: Arkadiusz Hydzik
Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-13125
Jan 17, 2025
Researcher: Dmitrii Ignatyev
Everest Forms <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-10471
Nov 5, 2024
Researcher: Dmitrii Ignatyev
Everest Forms <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-8542
Aug 1, 2024
Researcher: Dmitrii Ignatyev
Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url
7.2
CVE-2024-1812
Mar 15, 2024
Researcher: hir0ot
Everest Forms <= 2.0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-51695
Dec 27, 2023
Researcher: Robert DeVore
Everest Forms <= 2.0.3 - Unauthorized Form Submission via Disabled Forms
5.3
CVE-2023-51377
Dec 26, 2023
Researcher: Revan Arifio
Everest Forms <= 1.7.9 - Reflected Cross-Site Scripting
6.1
CVE-2021-24907
Nov 22, 2021
Researcher: ZhongFu Su
Contact Form, Drag and Drop Form Builder for WordPress – Everest Forms <= 1.4.9 - SQL Injection
9.8
CVE-2019-13575
Jul 18, 2019
Researcher: Tin Duong
Title Status CVE ID CVSS Researchers Date
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints Patched CVE-2026-13167 4.3 skyv3il August 15, 2026
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.4.8 - Reflected Cross-Site Scripting Patched CVE-2026-57312 6.1 bekitousei June 25, 2026
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending Patched CVE-2026-4888 4.3 Quốc Huy (jtwings) May 27, 2026
Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter Patched CVE-2026-5478 8.1 Bao Le April 20, 2026
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata Patched CVE-2026-3296 9.8 0xsabre April 7, 2026
Everest Forms <= 3.4.1 - Unauthenticated Arbitrary Shortcode Execution Patched CVE-2026-22422 6.5 Najib Sinjari September 26, 2025
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection Patched CVE-2025-3439 9.8 kuaile April 10, 2025
Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting Patched CVE-2025-3421 6.1 mikemyers April 10, 2025
Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Patched CVE-2025-3422 5.4 mikemyers April 10, 2025
Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion Patched CVE-2025-1128 9.8 Arkadiusz Hydzik February 17, 2025
Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-13125 4.4 Dmitrii Ignatyev January 17, 2025
Everest Forms <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-10471 4.4 Dmitrii Ignatyev November 5, 2024
Everest Forms <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2024-8542 4.4 Dmitrii Ignatyev August 1, 2024
Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url Patched CVE-2024-1812 7.2 hir0ot March 15, 2024
Everest Forms <= 2.0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2023-51695 4.4 Robert DeVore December 27, 2023
Everest Forms <= 2.0.3 - Unauthorized Form Submission via Disabled Forms Patched CVE-2023-51377 5.3 Revan Arifio December 26, 2023
Everest Forms <= 1.7.9 - Reflected Cross-Site Scripting Patched CVE-2021-24907 6.1 ZhongFu Su November 22, 2021
Contact Form, Drag and Drop Form Builder for WordPress – Everest Forms <= 1.4.9 - SQL Injection Patched CVE-2019-13575 9.8 Tin Duong July 18, 2019

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation