CVE Tools
Track your stack

Everest Forms

19 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Everest Forms, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Everest Forms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Everest Forms CVEs per month
MonthCVEs
2024-111
2024-120
2025-010
2025-022
2025-030
2025-043
2025-052
2025-061
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-040
2026-050
2026-061
2026-070
2026-080
2026-091
2026-102

Severity

How the 19 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical421%
  • High526%
  • Medium947%
  • Low15%

Latest CVEs

The 15 most recently published vulnerabilities affecting Everest Forms.

  1. CVE-2026-108491WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability7.1
  2. CVE-2026-94670WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability7.1
  3. CVE-2026-62103WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability9.8
  4. CVE-2026-57312WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1
  5. CVE-2026-22422WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability5.3
  6. CVE-2025-5927Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion7.5
  7. CVE-2024-8542Everest Forms < 3.0.3.1 - Admin+ Stored XSS4.8
  8. CVE-2025-26841Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload.6.1
  9. CVE-2025-3421Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting6.1
  10. CVE-2025-3422Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4
  11. CVE-2025-3439Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection9.8
  12. CVE-2025-1128Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion9.8
  13. CVE-2024-13125Everest Forms < 3.0.8.1 - Admin+ Stored XSS3.5
  14. CVE-2024-10471Everest Forms < 3.0.4.2 - Admin+ Stored XSS4.8
  15. CVE-2023-51377WordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerability5.3

Product grouping is registry-driven, with AI assist and human review. How it works