The vulnerability is a reflected cross‑site scripting flaw exposed through the 'form_id' query parameter in the Everest Forms WordPress plugin. Unsanitized input can be echoed back to the browser, enabling an unauthenticated attacker to inject arbitrary JavaScript that executes when a user views the reflected form. This allows theft of session data, credential hijacking, or malicious content delivery, directly compromising the confidentiality and integrity of end‑user browsers.

The flaw affects every installation of the Everest Forms plugin for WordPress version 3.1.1 and older. Users who have not upgraded past 3.1.1 are vulnerable irrespective of site role or authentication status. Native WordPress environments that host the plugin remain at risk until the upgrade is performed.

The CVSS base score of 6.1 indicates moderate severity, yet the EPSS score of less than 1% suggests a low exploitation probability at present. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the issue by crafting a malicious URL containing a forged 'form_id' value and luring a visitor to click the link, which causes the injected script to run in the victim’s browser.