CVE-2025-26841: XSS
Published May 12, 2025
·Updated
Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload.
Affected Software
2 affected components
WPEverest Everest Forms<3.0.9
WPEverest Everest Forms Wordpress<3.0.9
Event History
May 12, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-26841?
The severity of CVE-2025-26841 is classified as high due to its potential for allowing arbitrary code execution.
2
How do I fix CVE-2025-26841?
To fix CVE-2025-26841, update WPEVEREST Everest Forms to version 3.0.9 or later.
3
What type of vulnerability is CVE-2025-26841?
CVE-2025-26841 is a Cross Site Scripting (XSS) vulnerability.
4
What versions of Everest Forms are affected by CVE-2025-26841?
All versions of Everest Forms prior to 3.0.9 are affected by CVE-2025-26841.
5
Can an attacker exploit CVE-2025-26841 without authentication?
Yes, an attacker can exploit CVE-2025-26841 without authentication through a file upload.