CVE-2026-91152: Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evftoasttype' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evftoast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
Affected Software
Event History
Frequently Asked Questions
Which installations should be considered affected?
Everest Forms installations running version 3.6.2 or earlier are affected. The provided information does not identify any configuration prerequisite.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate, but must persuade a user to perform an action such as clicking a crafted link. The request must include an evf_toast value that successfully decodes with atob(); this is described as trivially attacker-controlled.
What is the likely impact if exploitation succeeds?
Attacker-supplied script can execute in the affected user's browser. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.