CVE-2026-12270

The Everest Forms WordPress plugin up to version 3.6.1 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in a form is executed in users' browsers.

Unauthenticated PHP Object Injection in Everest Forms versions 3.6.0 and below.

The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.

The Everest Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.

Reflected XSS vulnerability in Everest Forms plugin. Improper input neutralization during web page generation allows an attacker to inject malicious script that executes in the victim's browser. Affects versions from n/a through 3.6.1.

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.4.4. The load_previous_field_value() method accepts arbitrary URL values from $_POST data for upload fields without domain restriction, which are then passed to wp_remote_head(). This allows unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs.

The Everest Forms plugin for WordPress up to version 3.5.2 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with delegated form management access can activate arbitrary already-installed WordPress plugins, including previously deactivated or vulnerable ones, without holding the activate_plugins capability. This requires holding a delegated Everest Forms capability, which administrators can assign to non-administrators.

The Everest Forms WordPress plugin before version 3.5.0 does not reliably delete temporary CSV files generated during email notification processing, leaving them publicly accessible in the uploads directory. This allows unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.