CVE-2026-27070: Stored XSS in Everest Forms Pro

Successful exploitation of this XSS vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to a wide range of malicious activities, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive user data like login credentials or personal information. The stored nature of the vulnerability means that a single successful injection can impact multiple users who view the affected form, significantly expanding the potential blast radius. This is similar to other XSS vulnerabilities where attackers leverage user input to inject malicious code.

1. Reserved2026-02-17
2. Published2026-03-19
3. Modified2026-04-28
4. EPSS updated2026-03-26

The primary mitigation for CVE-2026-27070 is to immediately upgrade Everest Forms Pro to version 1.9.13 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input. Specifically, look for patterns associated with JavaScript injection attempts. Additionally, carefully review and sanitize all user-supplied input within the Everest Forms Pro plugin to prevent future vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload into a form field and verifying that it is not executed.