Executive brief
Everest Forms, a popular WordPress plugin used for building contact forms, contains a security flaw that could allow an attacker to execute malicious scripts in a user's browser. By tricking a site administrator or visitor into clicking a specially crafted link, an attacker could potentially steal session information, redirect users to malicious websites, or perform unauthorized actions on the site. This issue affects all versions up to 3.4.8 and has been resolved in version 3.5.0.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Everest Forms plugin for WordPress (versions <= 3.4.8) due to improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by sending a malicious link to a victim, such as a site administrator. If the victim clicks the link, the attacker's script is executed within the context of the victim's browser session. This can lead to session hijacking, unauthorized administrative actions, or website defacement. The vulnerability is patched in version 3.5.0.
Affected products
- WPEverest Everest Forms <= 3.4.8
Timeline
- 2026-05-18: disclosed: Reported by bekitousei to Patchstack
- 2026-06-25: advisory: Patchstack advisory published
- 2026-06-26: advisory: NVD published CVE-2026-57312
- 2026-06-25: patched: Version 3.5.0 released to address the vulnerability