The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder WordPress plugin versions up to 3.1.1 are vulnerable to reflected cross-site scripting via the 'form_id' parameter. This vulnerability is due to improper neutralization of input during web page generation (CWE-79), where input is not sufficiently sanitized or escaped before being included in output. An unauthenticated attacker can craft a URL containing malicious script in the 'form_id' parameter that executes in the context of a victim's browser if the victim clicks the link. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N).

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when the victim interacts with a maliciously crafted link. This can lead to limited confidentiality and integrity impacts such as theft of cookies or manipulation of page content. There is no direct availability impact. The vulnerability affects all versions up to and including 3.1.1 of the Everest Forms plugin. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links containing the 'form_id' parameter in URLs related to Everest Forms. Monitoring vendor channels for updates and applying patches promptly when released is recommended.