CVE-2026-108491

7.1High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Attackers can execute arbitrary JavaScript in the context of other users' browsers if they view an affected page. To trigger it, an attacker needs to submit malicious input that gets stored and rendered to a user.

Root cause

The plugin fails to sanitize and neutralize user-supplied input before rendering it on web pages, leading to stored cross-site scripting.

Affected systems

Everest Forms through 3.6.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Fix & remediation

Upgrade Everest Forms to a version newer than 3.6.1 once available. If patching must wait, deactivate the Everest Forms plugin.

shell

$ wp plugin update everest-forms

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.

References

https://patchstack.com/database/wordpress/plugin/everest-forms/vulnerability/wordpress-everest-forms-plugin-3-6-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108491