Everest Forms EUVD-2026-94487

Exploitation requires an attacker to deliver a crafted URL (reflected XSS) and have a victim actively open it in an authenticated-or-unauthenticated browser session on a site running Everest Forms version 3.6.1 or earlier - the victim interaction (UI:R) is the primary limiting factor, as the payload is not stored and must be triggered per-click. No attacker authentication is needed (PR:N). The exact vulnerable input/parameter within the plugin's form-generation flow is not specified in the available data, so the precise request shape cannot be confirmed; impact is bounded to the browser context of whoever follows the link rather than server-side compromise.

This is a medium-to-high severity reflected cross-site scripting (CWE-79) flaw in the Everest Forms WordPress plugin, carrying a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector indicates a network-accessible, low-complexity issue requiring no attacker privileges but DEPENDENT on victim user interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in the victim's browser context outside the vulnerable component. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so exploitation probability signals are absent rather than low - their absence should not be read as 'safe.' There is no SSVC decision data supplied. One notable inconsistency: Patchstack assigned Availability impact A:L, which is atypical for reflected XSS (session/UI disruption is usually non-availability-affecting); this modestly inflates the base score and should be treated with mild skepticism. Realistically this is a moderate-priority issue: reflected XSS is unauthenticated and network-reachable but gated by social engineering (a victim must follow an attacker-crafted link), making it opportunistic rather than wormable, and no evidence of active exploitation exists at time of analysis.

An attacker crafts a malicious URL containing a JavaScript payload that reflects unsanitized into a page generated by Everest Forms, then lures a logged-in administrator or site visitor into clicking it (e.g., via phishing email or malicious link). When the victim loads the page, the script executes in their browser session, enabling session token theft, forced form actions, or redirection. No public exploit code was identified at time of analysis, and successful exploitation hinges on tricking a user into following the crafted link.