Advisories · Technology

WPEverest Everest Forms Pro.

Every CVE that names WPEverest Everest Forms Pro among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-3300 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
- WPEverest Everest Forms Pro
- Code injection
Not analysed yet 31 Mar 2026
CVE-2026-27070 CVE record

CVSS 7.1 High

WordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability
- WPEverest Everest Forms Pro
- Cross-site scripting (XSS)
Not analysed yet 19 Mar 2026
CVE-2025-8871 CVE record

CVSS 5.6 Medium

Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
- WPEverest Everest Forms Pro
- Insecure deserialization
Not analysed yet 5 Nov 2025
CVE-2025-5927 CVE record

CVSS 7.5 High

Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion
- WPEverest Everest Forms Pro
- Path traversal
Not analysed yet 25 Jun 2025