WordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability

Successful exploitation of this XSS vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to a wide range of malicious activities, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive user data like login credentials or personal information. The stored nature of the vulnerability means that a single successful injection can impact multiple users who view the affected form, significantly expanding the potential blast radius. This is similar to other XSS vulnerabilities where attackers leverage user input to inject malicious code.

Websites utilizing Everest Forms Pro, particularly those with user-submitted form data, are at risk. Shared hosting environments where multiple WordPress installations share the same server resources are also at increased risk, as a compromised installation could potentially impact other sites on the same server.

• wordpress / composer / npm:

grep -r "<script" /var/www/html/wp-content/plugins/everest-forms-pro/*

• generic web:

curl -I https://your-wordpress-site.com/form-page | grep -i content-security-policy

• wordpress / composer / npm:

wp plugin list --status=inactive | grep everest-forms-pro

1. 2026-03-19Disclosure

   disclosure

1. आरक्षित2026-02-17
2. प्रकाशित2026-03-19
3. संशोधित2026-04-28
4. EPSS अद्यतन2026-03-26

The primary mitigation for CVE-2026-27070 is to immediately upgrade Everest Forms Pro to version 1.9.13 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input. Specifically, look for patterns associated with JavaScript injection attempts. Additionally, carefully review and sanitize all user-supplied input within the Everest Forms Pro plugin to prevent future vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload into a form field and verifying that it is not executed.