PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-94670 Everest Forms CVE debrief

The CVE-2026-94670 vulnerability in the Everest Forms plugin for WordPress allows attackers to inject malicious scripts into web pages, potentially leading to security incidents. This Cross Site Scripting (XSS) vulnerability affects versions up to 3.6.1 and is fixed in version 3.6.2. Defenders responsible for WordPress deployments using the Everest Forms plugin should assess exposure and prioritize updating to version 3.6.2 or later. The CVE record was published on 2026-10-07T16:57:43.166Z and has not been modified since then. AI-assisted PatchSiren debrief based on the supplied source corpus.

Vendor
Everest Forms
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-07
Original CVE updated
2026-10-07
Advisory published
2026-10-07
Advisory updated
2026-10-07

Who should care

Defenders responsible for WordPress deployments using the Everest Forms plugin should assess exposure and prioritize updating to version 3.6.2 or later.

Why it matters

The CVE-2026-94670 vulnerability in the Everest Forms plugin allows attackers to inject malicious scripts into web pages, potentially leading to security incidents. Defenders should prioritize verifying and updating the plugin, assessing exposure in their WordPress deployments, and monitoring for potential attacks.

  • Defenders should verify and update the Everest Forms plugin to prevent potential XSS attacks
  • Assess exposure in WordPress deployments to prioritize remediation
  • Monitor for potential XSS attacks to detect potential security incidents

Technical summary

The Everest Forms plugin has a Cross Site Scripting (XSS) vulnerability, which allows attackers to inject malicious scripts into web pages. The vulnerability affects versions up to 3.6.1 and is fixed in version 3.6.2. This issue, CVE-2026-94670, is a Reflected XSS vulnerability in Everest Forms. Defenders should prioritize verifying and updating the Everest Forms plugin to version 3.6.2 or later, and assess exposure in their WordPress deployments.

Defensive priority

Defenders should prioritize verifying and updating the Everest Forms plugin to version 3.6.2 or later, and assess exposure in their WordPress deployments.

Recommended defensive actions

  • Verify and update the Everest Forms plugin to version 3.6.2 or later
  • Assess exposure in WordPress deployments
  • Monitor for potential XSS attacks

Evidence notes

The CVE record and source item provide details on the Cross Site Scripting (XSS) vulnerability in the Everest Forms plugin, but do not provide information on exploitation or affected versions beyond 3.6.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-94670 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-94670

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-94670 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-94670

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.