CVE-2026-3300

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.

• CWE-94

• https://everestforms.net/changelog/
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/class-evf-form-task.php#L584
• https://www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=cve

Published

Mar 31, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32994The /api/v1/autotranslate.translateMessage endpoint in versi…5.3
• CVE-2026-32995The Rocket.Chat DDP method autoTranslate.translateMessage in…7.5
• CVE-2026-32996This vulnerability in Veeam Agent for Microsoft Windows allo…7.3
• CVE-2026-32997A vulnerability allowing an authenticated user with the Back…8.6
• CVE-2026-32998This vulnerability in Veeam Service Provider Console allows …9.4
• CVE-2026-32999Insufficient character filtering in backup agent signing mod…9
• CVE-2026-33000A malicious actor with access to the network and high privil…9.1
• CVE-2026-33001Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not …8.8
• CVE-2026-33002Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 th…7.5
• CVE-2026-33003Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja AP…4.3
• CVE-2026-33004Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadN…4.3
• CVE-2026-33005Improper Handling of Insufficient Privileges vulnerability i…4.3