CVE-2025-3422

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3422", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-07T14:57:54.833Z", "datePublished": "2025-04-11T12:42:24.394Z", "dateUpdated": "2026-04-08T16:47:44.159Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:44.159Z"}, "affected": [{"vendor": "wpeverest", "product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The The Everest Forms \u2013 Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes."}], "title": "Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3db1d9a0-ea68-4979-a36d-864c649f7aca?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3268742/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-04-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-11T13:17:35.006134Z", "id": "CVE-2025-3422", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T13:17:46.777Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3422", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-11T13:17:35.006134Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T13:17:41.327Z"}}], "cna": {"title": "Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpeverest", "product": "Everest Forms \u2013 Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3db1d9a0-ea68-4979-a36d-864c649f7aca?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3268742/"}], "descriptions": [{"lang": "en", "value": "The The Everest Forms \u2013 Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-04-11T12:42:24.394Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3422", "state": "PUBLISHED", "dateUpdated": "2025-04-11T13:17:46.777Z", "dateReserved": "2025-04-07T14:57:54.833Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-11T12:42:24.394Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder", "vendor": "wpeverest", "versions": [{"lessThanOrEqual": "3.1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpeverest:everest_forms:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "6ADE8340-DBBD-46D5-A34A-45EAFFEFD4DE", "versionEndExcluding": "3.1.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The The Everest Forms \u2013 Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes."}, {"lang": "es", "value": "El complemento The Everest Forms \u2013 Contact Form, Quiz, Survey, Newsletter &amp; Payment Form Builder para WordPress es vulnerable a la ejecuci\u00f3n de c\u00f3digos cortos arbitrarios en todas las versiones hasta la 3.1.1 incluida. Esto se debe a que el software permite a los usuarios ejecutar una acci\u00f3n que no valida correctamente un valor antes de ejecutar do_shortcode. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, ejecuten c\u00f3digos cortos arbitrarios."}], "id": "CVE-2025-3422", "lastModified": "2026-06-17T09:19:55.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3422", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-11T13:17:35.006134Z", "version": "2.0.3"}}]}, "published": "2025-04-11T13:15:40.950", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3268742/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3db1d9a0-ea68-4979-a36d-864c649f7aca?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T04:13:46.739715+00:00", "value": {"mitigation_remediation": ["Upgrade Everest Forms to version\u00a03.1.2 or later to remove the unsafe shortcode processing.", "Revoke the \"Unfiltered HTML\" capability from the Subscriber role so that even authenticated subscribers cannot inject shortcodes that could be executed by the parser.", "Monitor the site for unexpected shortcode usage and audit custom content to detect potential injection attempts."], "summary": {"action": "Update Plugin", "impact": "Arbitrary Shortcode Execution"}, "threat_synthesis": {"affected_systems": "The Everest Forms \u2013 Contact Form, Quiz, Survey & Custom Form Builder plugin for WordPress, any release up to and including version\u00a03.1.1, is affected. The vulnerability is present in all versions prior to 3.1.2.", "description_and_impact": "The Everest Forms plugin accepts content that is passed directly to WordPress\u2019s shortcode parser without validating the value supplied by the user. This flaw allows an authenticated user with Subscriber level or higher to inject malicious shortcodes. The shortcodes are then executed by the system, potentially enabling PHP code execution through well\u2011known shortcode hooks, thereby creating a code\u2011injection vector (CWE\u201194). If an attacker can supply a payload that triggers a dangerous shortcode, the attacker may tamper with site data, exfiltrate information, or take full control of the WordPress site if additional vulnerabilities exist.", "risk_and_exploitability": "The CVSS score of\u00a05.4 classifies the flaw as moderate severity, while the EPSS score of less than\u00a01% indicates a very low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker requires valid login credentials with Subscriber or higher privileges to create or modify the content that is subsequently passed to the shortcode parser. The attack surface is therefore limited to authenticated users who can interact with Everest Forms\u2019 interface."}}}}, "created": "2026-04-22T04:15:07.540669+00:00", "updated": "2026-04-22T04:15:07.540679+00:00", "vendors": []}