The Everest Forms plugin accepts content that is passed directly to WordPress’s shortcode parser without validating the value supplied by the user. This flaw allows an authenticated user with Subscriber level or higher to inject malicious shortcodes. The shortcodes are then executed by the system, potentially enabling PHP code execution through well‑known shortcode hooks, thereby creating a code‑injection vector (CWE‑94). If an attacker can supply a payload that triggers a dangerous shortcode, the attacker may tamper with site data, exfiltrate information, or take full control of the WordPress site if additional vulnerabilities exist.

The Everest Forms – Contact Form, Quiz, Survey & Custom Form Builder plugin for WordPress, any release up to and including version 3.1.1, is affected. The vulnerability is present in all versions prior to 3.1.2.

The CVSS score of 5.4 classifies the flaw as moderate severity, while the EPSS score of less than 1% indicates a very low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker requires valid login credentials with Subscriber or higher privileges to create or modify the content that is subsequently passed to the shortcode parser. The attack surface is therefore limited to authenticated users who can interact with Everest Forms’ interface.