PT-2026-26281 · Unknown · Everest Forms Pro

Kishan Vyas · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-27070

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Everest Forms Pro versions through 1.9.10

Description The software contains a flaw related to improper input handling during web page generation, which allows for Cross-site Scripting (XSS). This specific instance is a Stored XSS, meaning malicious scripts can be stored on the target server and executed by other users. The affected component allows an attacker to inject malicious code into web pages. The vulnerable parameter is not specified.

Recommendations Update Everest Forms Pro to a version later than 1.9.10.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27070

Produtos afetados

Everest Forms Pro

Referências · 4

• https://twitter.com/CVEnew/status/2036024220518621524 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Plugin/everest-forms-pro/vulnerability/wordpress-everest-forms-pro-plugin-1-9-10-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://patchstack.com/database/wordpress/plugin/everest-forms-pro/vulnerability/wordpress-everest-forms-pro-plugin-1-9-10-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27070 · Nota de Segurança