Everest Forms CVE-2026-91152

Requires that the Everest Forms plugin (version ≤ 3.6.2) be installed and active, and that an attacker lure a user into clicking a crafted link (UI:R) - reflected XSS is not self-triggering. The payload is injected via the 'evf_toast_type' parameter handled in the plugin's admin assets JavaScript (admin.js toast handling), and the sibling 'evf_toast' parameter must base64-decode successfully via atob(), which the description states is a trivially attacker-controlled prerequisite that does not meaningfully limit exploitation. No authentication is needed to craft or deliver the link (PR:N). The practical limiting factors are the need for victim interaction and the reflected (per-request, non-persistent) nature of the flaw, meaning impact is scoped to users who click the attacker's URL rather than all site visitors.

This is a reflected XSS (CWE-79) scored CVSS 6.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable and unauthenticated (PR:N), low complexity (AC:L), but gated on user interaction (UI:R), with limited confidentiality/integrity impact and a changed scope reflecting execution in the victim's browser context. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a reflected (not stored) client-side flaw that needs social engineering. No CISA KEV listing is present in the input (not confirmed actively exploited), and no EPSS score was supplied, so widespread automated exploitation cannot be asserted or ruled out from the data given. No public exploit or PoC reference is present - the references are a Wordfence advisory and WordPress trac source/changeset links, not weaponized exploit code. Net assessment: a genuine but moderate-priority issue - real because it is unauthenticated and trivially triggerable per the description, but bounded because it is reflected and requires tricking a user into clicking an attacker-crafted link. Treat as a this-month patch item, not a drop-everything emergency, absent any KEV/EPSS signal to the contrary.

An unauthenticated attacker crafts a URL to a site running Everest Forms with a malicious script in the 'evf_toast_type' parameter and a companion 'evf_toast' value that base64-decodes via atob(). When a logged-in user (e.g., an administrator) is lured into clicking the link, the unsanitized value is reflected and the injected script executes in their browser session. No public exploit code is referenced, but the described trigger is straightforward.