The vulnerability is a stored XSS flaw in the Everest Forms Pro plugin that allows malicious input submitted through its form interface to be saved and later rendered without proper neutralization. When a user views a page that displays the stored form data, the injected script executes in the victim’s browser, which can lead to credential theft, session hijacking, defacement, or other browser‑based attacks.

All WordPress installations that have the Everest Forms Pro plugin with a version of 1.9.10 or earlier are affected; versions older than 1.9.10 are also vulnerable.

The CVSS score of 7.1 indicates a medium‑to‑high severity issue. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves a user (or attacker with form submission access) submitting malicious data via the plugin’s form; this input is stored and later displayed, causing XSS. Exploitation does not appear to require privileged access beyond the existence of the plugin and the ability to submit form data.