Wpeverest Everest Forms Pro vulnerabilities

CVE-2026-3300 [CRITICAL] CWE-94 CVE-2026-3300: The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injec The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_

CVE-2026-27070 [HIGH] CWE-79 CVE-2026-27070: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms Pro allows Stored XSS.This issue affects Everest Forms Pro: from n/a through 1.9.10.

CVE-2025-8871 [MEDIUM] CWE-502 CVE-2025-8871: The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions u The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a f

CVE-2025-5927 [HIGH] CWE-36 CVE-2025-5927: The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insuffi The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when t