Everest Forms Pro vulnerabilities

3 known vulnerabilities in Everest Forms Pro from Wpeverest. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Everest Forms Pro: Improper Control of Generation of Code

  CVE-2026-3300Mar 31, 2026WpeverestEPSS 39.2%

  The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field valu

• 7.1 High severity

  Everest Forms Pro: Improper Neutralization of Input During Web Page Generation

  CVE-2026-27070Mar 19, 2026Wpeverest

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms Pro allows Stored XSS.This issue affects Everest Forms Pro: from n/a through 1.9.10.

• 7.5 High severity

  Everest Forms Pro: Absolute Path Traversal

  CVE-2025-5927Jun 25, 2025Wpeverest

  The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attacker