Untainted user input is reflected by Everest Forms versions up to 3.4.8, allowing an attacker to inject arbitrary JavaScript into the rendered page. The flaw falls under CWE-79 and could be used to hijack user sessions or deliver malware through the site.

The vulnerability affects WordPress sites that use the Everest Forms plugin version 3.4.8 or earlier. The impact is confined to sites where the plugin is active and publicly accessible.

The CVSS score of 7.1 indicates a high severity, though the EPSS score is unavailable and the vulnerability is not yet in the KEV catalog. Because it is unauthenticated and reflected, an attacker can exploit it simply by crafting a URL or form input, making it straightforward for a malicious actor to inject code into the visitor's browser.