Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI vulnerabilities

Product

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

by wpeverest · last CVE Oct 29, 2026

CVEs

On KEV

6.1

Max CVSS

New 30D

Vulnerabilities4 In the news0 Timeline

Severity mix

Critical 0High 0Medium 4Low 0

Severity

All severities4 Critical0 High0 Medium4 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-91152 New	6.1	0%	Oct 29	Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter Affected: through 3.6.2
CVE-2026-91153 New	5.3	1%	Oct 29	Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...}) Affected: through 3.6.2
CVE-2026-5096	5.3	0%	Aug 28	Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' Affected: through 3.4.4
CVE-2026-13167	4.3	0%	Aug 16	Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints Affected: through 3.5.2