4.8
Medium
CVE-2024-8542 The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could…
Description
The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Everest Forms 3.0 | earliest → < 3.0.3.1 | 3.0.3.1 |
Other CVEs of Everest Forms
The 5 CVEs of Everest Forms →
CVE-2026-12270
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints…
6.5
Medium
CVE-2026-11571
The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during…
7.5
High
CVE-2024-13125
The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could…
3.5
Low
CVE-2024-10471
The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could…
4.8
Medium