Reflected Cross-Site Scripting Vulnerability in Everest Forms Plugin by WordPress
CVE-2025-3421
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 April 2025
What is CVE-2025-3421?
The Everest Forms plugin for WordPress is exposed to a vulnerability due to inadequate sanitization and escaping of the 'form_id' parameter. This flaw allows unauthenticated attackers to execute arbitrary web scripts if users are deceived into clicking malicious links. It is crucial for website administrators to either upgrade to the latest version or implement security measures to mitigate potential exploitation.
Affected Version(s)
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress * <= 3.1.1