The vulnerability is a classic cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into pages rendered by the Everest Forms plugin. This flaw arises from the plugin’s failure to properly neutralize script‑related HTML tags, enabling arbitrary code execution within a victim’s browser session. The impact could include credential theft, defacement, or further exploitation of the site.

Vendors: wpeverest; Product: Everest Forms; Affected versions: all releases up to and including 3.4.1.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Attackers would most likely exploit this via crafted content that triggers the vulnerable shortcode, requiring access to a location where the plugin processes user‑generated input. Given the moderate severity and low exploitation probability, the risk is low to moderate but warrants patching to prevent potential abuse.