The vulnerability CVE-2026-22422 in wpeverest Everest Forms involves improper neutralization of script-related HTML tags in web pages, enabling a basic cross-site scripting (XSS) attack. This issue affects Everest Forms versions up to 3.4.1. The CVSS 3.1 base score is 5.3 (medium), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to integrity (code injection). There is no indication of a vendor patch or official remediation in the provided data.

An attacker can inject malicious script code into web pages generated by Everest Forms, potentially altering the integrity of the affected web content. The vulnerability does not affect confidentiality or availability. Exploitation could allow code injection but no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting access to form inputs or applying web application firewall rules to detect and block script injection attempts. Monitor vendor channels for updates and patches.