CVE-2024-13125: 
WordPress vulnerability analysis and mitigation

The Everest Forms WordPress plugin before version 3.0.8.1 contains a stored Cross-Site Scripting (XSS) vulnerability. The issue stems from inadequate sanitization and escaping of certain plugin settings, potentially allowing high-privilege users such as administrators to perform stored XSS attacks, even in environments where the unfiltered_html capability is disabled, such as in multisite setups (WPScan).

The vulnerability is classified as a Stored XSS issue with a CVSS score of 3.5 (low severity) and is categorized under OWASP Top 10 A7: Cross-Site Scripting (XSS) and CWE-79. The vulnerability was discovered by Dmitrii Ignatyev and was publicly disclosed on January 23, 2025 (WPScan).

The vulnerability allows high-privilege users to inject malicious scripts into the plugin's settings, specifically in the email notification templates. When other administrators preview these email templates, the injected scripts can execute in their browsers, potentially leading to unauthorized actions or data theft (WPScan).

The vulnerability has been patched in version 3.0.8.1 of the Everest Forms plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).