Everest Forms WordPress plugin reflected XSS enables script execution in user browsers

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.

• The Everest Forms package everest-forms is recorded as affected from n/a through 3.6.1.
• The change record marks 3.6.2 as unaffected.
• The product record sets the default status to unaffected outside the listed affected range.
• The available record does not specify additional release branches or other Everest Forms deployments.

This is a CWE-79 reflected cross-site scripting flaw caused by improper neutralization of input during web page generation. Consistent with the recorded flaw class, attacker-controlled input may be reflected into a response and processed as script by a browser. The record supports network reachability, no required privileges, low attack complexity, and required user interaction. The endpoint, parameter, HTML context, and payload are not disclosed, so the precise injection point and browser-side execution path remain unknown. The affected component is the Everest Forms WordPress plugin/package everest-forms; the available evidence does not establish whether other Everest Forms integrations or separate plugin branches are affected.

• The issue is reachable over the network and does not require attacker privileges; the structured record sets Privileges Required to none.
• User Interaction is required, meaning a victim must open, visit, or act on attacker-controlled content.
• Patchstack describes the required privilege as unauthenticated, consistent with the no-privilege requirement in the structured record.
• The CISA ADP enrichment in the record marks exploitation as none and automatable as no. This is an assessment within that source's scope and does not prove exploitation is impossible.
• The record does not identify a public exploit or a specific exploitation campaign.

Successful exploitation could execute attacker-controlled script in a user's browser under the context of the affected website. Depending on the victim's permissions and the data available to the browser, this could enable data access, content changes, or actions performed on the user's behalf. The record describes low confidentiality, integrity, and availability impact with changed scope, but it does not provide the endpoint or execution context needed to determine the outcome in a particular deployment. Because user interaction is required, the impact depends on a victim opening or interacting with attacker-controlled content. The available evidence does not identify a specific victim, campaign, or compromise.

A site running the affected plugin may cause users or administrators to execute attacker-controlled script when they interact with malicious content. Depending on the browser context and the user's permissions, possible consequences include exposure of data available to the browser session, unauthorized page actions, content modification, or service disruption. These are possible outcomes, not evidence that data was accessed or that a site was compromised. Because attacker privileges are not required but user interaction is required, risk depends substantially on whether malicious content or links reach the intended users.

1. Update the Everest Forms WordPress plugin to the latest available version, with 3.6.2 identified by the supplied solution as the minimum version and marked unaffected by the affected-product record.
2. After updating, verify that package everest-forms is running the remediated version across every website and deployment environment.
3. If an update cannot be completed immediately, Patchstack states that a mitigation rule is available to block attacks until the update is applied. Treat that mitigation as temporary and not as a replacement for upgrading.

1. Inventory WordPress sites that have the everest-forms package installed and record the deployed version.
2. Compare inventory results with the affected and remediated version boundaries in the product record.
3. Review requests and responses associated with Everest Forms functionality for user input being unexpectedly reflected into HTML or script contexts. This is a precautionary check, not a vendor-confirmed indicator of compromise.
4. Investigate reports of unexpected script execution, page changes, unauthorized actions, or unusual user-session behavior after users follow external links. Absence of such log evidence does not prove that a deployment is safe.