What is the CVSS score of EUVD-2026-39725?

EUVD-2026-39725 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Everest Forms are affected by EUVD-2026-39725?

Everest Forms WordPress plugin (v3.4.8 and earlier) contains a reflected XSS vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in visitor browsers, potentially stealing…

How to fix or mitigate EUVD-2026-39725?

Within 24 hours: Disable Everest Forms plugin immediately across all WordPress instances; inventory all sites running Everest Forms 3.4.8 or earlier; search logs for suspicious referrer patterns containing script tags. Within 7 days: Maintain affected sites in maintenance mode; monitor vendor advisory channels daily for patch release; audit server logs and database for exploitation indicators (suspicious form submissions, unusual POST requests to form endpoints). Within 30 days: Apply vendor-released patch when available (monitor Everest Forms official repository); re-enable plugin only in patched versions; implement WAF rules blocking common XSS payloads on form endpoints.

Everest Forms EUVD-2026-39725

| CVE-2026-57312 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-j2w9-xgpf-ccm7

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-reachable reflected XSS, no auth, but requires a victim click (UI:R); scope changes into the browser context (S:C) with low confidentiality/integrity impact and no genuine availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:55 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.

AnalysisAI

Reflected cross-site scripting in the Everest Forms WordPress plugin (versions 3.4.8 and earlier) lets an unauthenticated attacker craft a malicious link that, when opened by a victim, executes arbitrary JavaScript in the victim's browser under the affected site's origin. The CVSS:3.1 base score is 7.1 (scope-changed, low impact across C/I/A) and exploitation requires victim user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Everest Forms is a widely deployed WordPress drag-and-drop contact/form-builder plugin. The issue is CWE-79 (Improper Neutralization of Input During Web Page Generation), the root-cause class for cross-site scripting. In a reflected XSS, attacker-controlled input supplied via a request parameter is echoed back into the HTTP response without proper output encoding or input sanitization, so the browser parses it as executable markup/script rather than data. Because the plugin runs inside WordPress, the injected script executes in the security context (origin) of the hosting site. The vector's Scope:Changed (S:C) reflects that impact crosses from the vulnerable component into the victim's browser/session context. No CPE string was supplied in the input.

RemediationAI

Upgrade Everest Forms to a fixed release newer than 3.4.8 once published by the vendor; the input data does not include a confirmed fixed version, so verify the exact patched version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/everest-forms/vulnerability/wordpress-everest-forms-plugin-3-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress.org plugin changelog before deploying. If immediate patching is not possible, deploy a WAF or virtual patch (Patchstack and similar vendors offer XSS rule coverage) to filter payloads on the plugin's request parameters, and set a restrictive Content-Security-Policy header to block untrusted/inline script execution - noting CSP can break legitimate inline scripts and themes and should be rolled out in report-only mode first. Advise privileged users not to click untrusted links targeting the site, since exploitation depends on victim interaction.