Everest Forms Pro

Everest Forms Pro has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 7.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Absolute Path Traversal, behind 1 of the records (25%). Other recurring categories include Code Injection, Cross-Site Scripting.

Every one of the 4 issues recorded for Everest Forms Pro has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each.

01234567891024.06.2025Today24.06.20257.5Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion CVSS 7.5 · 24.06.202504.11.20255.6Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature CVSS 5.6 · 04.11.202512.03.20267.2Everest Forms Pro <= 1.9.12 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 12.03.202630.03.20269.8Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field CVSS 9.8 · 30.03.2026

Strategic Overview

Avg CVSSHigh
7.5/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all Everest Forms Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-3300

Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

Read the full analysis

Vulnerability Records

4 records
Showing 1–4 of 4 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C