CVE-2025-3421

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-3421

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3421.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-3421

Published

2025-04-11T12:42:24.777Z

Modified

2026-07-15T01:49:19.500961174Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting

Details

The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "3.1.1"
                }
            ]
        }
    ],
    "cna_assigner": "Wordfence",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3421.json",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/wpeverest/everest-forms

Affected ranges

Type

GIT

Repo

https://github.com/wpeverest/everest-forms

Events

Introduced

Fixed

fec4f84a52a75bd988ce1b708e65bdc39386587d

Database specific

{
    "cpe": "cpe:2.3:a:wpeverest:everest_forms:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.1.0-rc.1

1.1.3

1.1.4

1.2.0

1.2.0-rc.1

1.3.0

1.3.2

1.3.4

1.4.0

1.4.0-beta

1.4.0-beta2

1.4.0-beta3

1.4.0-beta4

1.4.0-beta5

1.4.0-beta6

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.8

1.4.9

1.5.0

1.5.1

1.5.10

1.5.2

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.6.1

1.6.7

1.7.0

1.7.0.1

1.7.0.2

1.7.0.3

1.7.1

1.7.2

1.7.2.1

1.7.2.2

1.7.3

1.7.4

1.7.5

1.7.5.1

1.7.5.2

1.7.6

1.7.7

1.7.7.1

1.7.7.2

1.7.8

1.7.9

1.8.0

1.8.0.1

1.8.1

1.8.2

1.8.2.1

1.8.2.2

1.8.2.3

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9.0

1.9.0.1

1.9.1

1.9.2

1.9.3

1.9.4

1.9.4.1

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

2.*

2.0.0

2.0.0.1

2.0.1

2.0.3

2.0.3.1

2.0.5

2.0.6

2.0.7

2.0.8

2.0.8.1

2.0.9

3.*

3.0.0

3.0.0.1

3.0.1

3.0.2

3.0.3

3.0.3.1

3.0.4

3.0.4.1

3.0.4.2

3.0.5

3.0.5.1

3.0.5.2

3.0.6

3.0.9

3.0.9.1

3.1.1

v1.*

v1.4.0-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3421.json"