CVE-2025-3421: Everest Forms XSS Vulnerability

CVE-2025-3421 Overview

CVE-2025-3421 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Everest Forms WordPress plugin, a contact form, quiz, survey, newsletter, and payment form builder developed by WPEverest. The flaw affects all plugin versions up to and including 3.1.1 and stems from insufficient input sanitization and output escaping on the form_id parameter [CWE-79]. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim is tricked into clicking a crafted link. The issue was corrected in version 3.1.2.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of a targeted user's browser session, enabling session theft, credential harvesting, and administrative account takeover through a single click.

Affected Products

WPEverest Everest Forms plugin for WordPress, all versions through 3.1.1
WordPress sites using the Contact Form, Quiz, Survey, Newsletter, and Payment Form Builder
Any site exposing the form-preview template through the vulnerable form_id parameter

Discovery Timeline

2025-04-11 - CVE-2025-3421 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3421

Vulnerability Analysis

The vulnerability resides in the Everest Forms plugin's form preview functionality. The form_id request parameter flows into the evf-form-preview-template.php template without adequate sanitization or output escaping. When a victim visits a URL containing an attacker-controlled form_id value, the reflected payload renders as executable HTML or JavaScript in the response.

Because the vulnerability is reflected and requires user interaction, attackers typically deliver it through phishing links, malicious advertisements, or trusted third-party sites. Successful exploitation runs in the origin of the vulnerable WordPress site, granting access to the victim's session cookies, DOM contents, and any authenticated actions the victim can perform. When the victim is a WordPress administrator, the impact extends to arbitrary site modification and plugin manipulation.

Root Cause

The form preview template concatenates the form_id request value into HTML output without applying WordPress escaping helpers such as esc_attr() or esc_html(). The vendor patch, applied in changeset 3268742, introduced proper escaping in the evf-form-preview-template.php file. Review the Everest Forms Template Changeset for the corrected implementation.

Attack Vector

An attacker crafts a URL to a vulnerable WordPress site containing a malicious payload inside the form_id query parameter and delivers it to a target user. When the victim clicks the link, the payload reflects into the rendered page and executes under the site's origin. The attack requires no authentication but does require user interaction. The vulnerability manifests in the form preview rendering path; see the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-3421

Indicators of Compromise

HTTP requests to WordPress endpoints containing suspicious characters in the form_id parameter, such as <script>, onerror=, javascript:, or URL-encoded equivalents like %3Cscript%3E.
Access log entries referencing the Everest Forms preview endpoint paired with unusually long or encoded form_id values.
Referrer headers from external domains preceding requests to the form preview template.

Detection Strategies

Inspect web server and WordPress access logs for form_id parameter values containing HTML tags, script keywords, or encoded angle brackets.
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS patterns targeting the form_id query parameter.
Use plugin inventory scanning to identify WordPress sites running Everest Forms at version 3.1.1 or earlier.

Monitoring Recommendations

Alert on outbound requests from user browsers to unknown domains immediately after visits to form preview URLs.
Track administrator session anomalies such as new sessions from unexpected IP addresses or user agents after clicking external links.
Monitor for unauthorized changes to WordPress users, plugins, or theme files that could indicate a follow-on compromise.

How to Mitigate CVE-2025-3421

Immediate Actions Required

Update the Everest Forms plugin to version 3.1.2 or later on all WordPress sites in your environment.
Audit administrator accounts and force password resets and session invalidation if suspicious activity is present in logs.
Restrict administrative access to trusted networks until patching is confirmed across all instances.

Patch Information

WPEverest addressed the vulnerability in Everest Forms version 3.1.2. The fix, applied in WordPress Plugins Changeset 3268742, adds proper output escaping to the form_id parameter within the form preview template. Administrators should install the update through the WordPress plugin manager or via the plugin repository.

Workarounds

Deactivate the Everest Forms plugin until the update to 3.1.2 can be deployed.
Configure WAF or reverse proxy rules to strip or reject requests where form_id contains angle brackets, script keywords, or encoded HTML.
Apply a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of reflected payloads.

bash

# Example WAF rule (ModSecurity) to block XSS payloads in form_id
SecRule ARGS:form_id "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
    "id:1003421,phase:2,deny,status:403,\
    msg:'CVE-2025-3421 Everest Forms XSS attempt in form_id parameter'"