CVE-2026-22422 PUBLISHED

WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability

Assigner: Patchstack
Reserved: 07.01.2026 Published: 19.02.2026 Updated: 19.02.2026

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This issue affects Everest Forms: from n/a through <= 3.4.1.

Product Status

Vendor	wpeverest
Product	Everest Forms
Versions	Default: unaffected affected from n/a to <= 3.4.1 (incl.)

Credits

Najib Sinjari | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/Wordpress/Plugin/everest-forms/vulnerability/wordpress-everest-forms-plugin-3-4-1-arbitrary-shortcode-execution-vulnerability?_s_id=cve

Problem Types

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CWE

Impacts

Code Injection