PT-2026-26281 · Unknown · Everest Forms Pro

Kishan Vyas · CVE-2026-27070 · Published 2026-03-19 · Updated 2026-03-23

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Everest Forms Pro versions through 1.9.10

Description The software contains a flaw related to improper input handling during web page generation, which allows for Cross-site Scripting (XSS). This specific instance is a Stored XSS, meaning malicious scripts can be stored on the target server and executed by other users. The affected component allows an attacker to inject malicious code into web pages. The vulnerable parameter is not specified.

Recommendations Update Everest Forms Pro to a version later than 1.9.10.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27070

Affected Products

Everest Forms Pro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-27070 · Security Note
• https://twitter.com/CVEnew/status/2036024220518621524 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/everest-forms-pro/vulnerability/wordpress-everest-forms-pro-plugin-1-9-10-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/everest-forms-pro/vulnerability/wordpress-everest-forms-pro-plugin-1-9-10-cross-site-scripting-xss-vulnerability?_s_id=cve · Note