The vulnerability enables an attacker to inject malicious scripts that are stored and later rendered by anyone viewing the affected page. Stored XSS can lead to credential theft, session hijacking, or defacement if the script runs in a user’s browser. The weakness originates from improper neutralization of input and is classified as a standard XSS flaw.

Everest Forms plugin version 3.6.1 and earlier on WordPress installations. The issue affects all sites that have the plugin installed from any version up to and including 3.6.1.

The CVSS score of 7.1 indicates a high impact with medium to high exploitation potential. The EPSS score of less than 1% shows that the probability of public exploitation is currently low, and the vulnerability is not listed in CISA KEV. Attackers would exploit the flaw by submitting crafted form data that stores a script; when an administrator or any user later views the form page, the script executes in the victim’s browser. Given that the vector is a web interface with authenticated or unauthenticated access to form submissions, the risk remains significant for sites that rely on Everest Forms for input collection.