Everest Forms Contact Form Payment Form Quiz Survey Custom Form Builder With Ai
Monthly
Unauthenticated attackers can extract arbitrary WordPress post meta values - including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type - from WordPress sites running the Everest Forms plugin through version 3.6.2. The submission nonce is rendered publicly in every embedded form and can also be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, so a crafted form submission containing a smart tag such as {post_meta key="..."} is resolved by the plugin instead of being treated as inert user input; the resolved value then surfaces in a form notification email or a stored entry. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code was identified at time of analysis and it is not in CISA KEV, but the practical barrier is low wherever the exfiltration destination can be observed; the priority label is this_month.
Reflected cross-site scripting (CWE-79) in the Everest Forms WordPress plugin affects all versions up to and including 3.6.2, where the 'evf_toast_type' parameter is handled by the plugin's admin JavaScript without sufficient sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) shows the flaw is network-reachable and requires no authentication to craft or deliver a malicious link, but exploitation is gated on user interaction - a victim must be tricked into clicking the attacker's URL, and the injected script then runs in that user's browser session within the site's origin (changed scope). A sibling 'evf_toast' parameter must base64-decode successfully via atob(), a trivially attacker-controlled prerequisite that does not meaningfully limit exploitation; there is no confirmed CISA KEV entry and no public exploit code identified at time of analysis, and the flaw is reflected and per-request rather than persistent.
Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.
Authorization bypass in the Everest Forms WordPress plugin (all versions ≤ 3.5.2) allows authenticated attackers holding any delegated Everest Forms capability to activate arbitrary already-installed WordPress plugins - including previously deactivated or known-vulnerable ones - without the WordPress core `activate_plugins` capability. The flaw exists in AJAX handlers (`class-evf-ajax.php`) and REST API endpoints (`class-evf-modules.php`) that issue nonces to any delegated EVF user on admin pages but fail to enforce the required core capability before executing plugin activation. No public exploit is identified at time of analysis, though Wordfence has published direct source code references to the vulnerable handlers, reducing the research burden for potential exploitation.
Unauthenticated attackers can extract arbitrary WordPress post meta values - including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type - from WordPress sites running the Everest Forms plugin through version 3.6.2. The submission nonce is rendered publicly in every embedded form and can also be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, so a crafted form submission containing a smart tag such as {post_meta key="..."} is resolved by the plugin instead of being treated as inert user input; the resolved value then surfaces in a form notification email or a stored entry. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code was identified at time of analysis and it is not in CISA KEV, but the practical barrier is low wherever the exfiltration destination can be observed; the priority label is this_month.
Reflected cross-site scripting (CWE-79) in the Everest Forms WordPress plugin affects all versions up to and including 3.6.2, where the 'evf_toast_type' parameter is handled by the plugin's admin JavaScript without sufficient sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) shows the flaw is network-reachable and requires no authentication to craft or deliver a malicious link, but exploitation is gated on user interaction - a victim must be tricked into clicking the attacker's URL, and the injected script then runs in that user's browser session within the site's origin (changed scope). A sibling 'evf_toast' parameter must base64-decode successfully via atob(), a trivially attacker-controlled prerequisite that does not meaningfully limit exploitation; there is no confirmed CISA KEV entry and no public exploit code identified at time of analysis, and the flaw is reflected and per-request rather than persistent.
Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.
Authorization bypass in the Everest Forms WordPress plugin (all versions ≤ 3.5.2) allows authenticated attackers holding any delegated Everest Forms capability to activate arbitrary already-installed WordPress plugins - including previously deactivated or known-vulnerable ones - without the WordPress core `activate_plugins` capability. The flaw exists in AJAX handlers (`class-evf-ajax.php`) and REST API endpoints (`class-evf-modules.php`) that issue nonces to any delegated EVF user on admin pages but fail to enforce the required core capability before executing plugin activation. No public exploit is identified at time of analysis, though Wordfence has published direct source code references to the vulnerable handlers, reducing the research burden for potential exploitation.