CVE-2024-13125

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-13125

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13125.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-13125

Published

2025-02-13T06:00:12.331Z

Modified

2026-07-15T01:48:54.831142871Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Everest Forms < 3.0.8.1 - Admin+ Stored XSS

Details

The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13125.json",
    "cna_assigner": "WPScan",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "3.0.8.1"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "3.0.8.1"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/wpeverest/everest-forms

Affected ranges

Type

GIT

Repo

https://github.com/wpeverest/everest-forms

Events

Introduced

Fixed

3b7830ab96fe54a26551f4cdf108c32f414ff029

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:wpeverest:everest_forms:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.8.1"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.1.0-rc.1

1.1.3

1.1.4

1.2.0

1.2.0-rc.1

1.3.0

1.3.2

1.3.4

1.4.0

1.4.0-beta

1.4.0-beta2

1.4.0-beta3

1.4.0-beta4

1.4.0-beta5

1.4.0-beta6

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.8

1.4.9

1.5.0

1.5.1

1.5.10

1.5.2

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.6.1

1.6.7

1.7.0

1.7.0.1

1.7.0.2

1.7.0.3

1.7.1

1.7.2

1.7.2.1

1.7.2.2

1.7.3

1.7.4

1.7.5

1.7.5.1

1.7.5.2

1.7.6

1.7.7

1.7.7.1

1.7.7.2

1.7.8

1.7.9

1.8.0

1.8.0.1

1.8.1

1.8.2

1.8.2.1

1.8.2.2

1.8.2.3

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9.0

1.9.0.1

1.9.1

1.9.2

1.9.3

1.9.4

1.9.4.1

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

2.*

2.0.0

2.0.0.1

2.0.1

2.0.3

2.0.3.1

2.0.5

2.0.6

2.0.7

2.0.8

2.0.8.1

2.0.9

3.*

3.0.0

3.0.0.1

3.0.1

3.0.2

3.0.3

3.0.3.1

3.0.4

3.0.4.1

3.0.4.2

3.0.5

3.0.5.1

3.0.5.2

3.0.6

3.0.6.1

3.0.7.1

3.0.8

v1.*

v1.4.0-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13125.json"