CVE-2026-91152mediumCWE-79

CVE-2026-91152: medium-severity vulnerability in wpeverest Everest Forms – Contact Form…

Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter

Published

Follow this CVE+ Monitor Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.3%
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Related CVEs — wpeverest Everest Forms – Contact Form…

In the same product, most dangerous first.

CVE-2026-91153MEDIUMEverest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})EPSS 0.6%CVE-2026-13167MEDIUMEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX EndpointsEPSS 0.5%CVE-2026-89101MEDIUMEverest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC EndpointEPSS 0.4%CVE-2026-5096MEDIUMEverest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'EPSS 0.4%