Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
1 selected

2 records

Release: Everest Forms 3.5.0 Clear all filters
TI-2026-10551 CVE-2026-12270 · GHSA-v4gv-5wcc-cjvx

Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints

Priority HIGH 68

The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable r…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00298 Published 2026-07-09 Fixed in 3.5.0
TI-2026-09993 CVE-2026-11571 · GHSA-32jc-cm64-7hx3

Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts

Priority HIGH 72

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthent…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00434 Published 2026-07-09 Fixed in 3.5.0