CVE-2026-94670

{
  "etk_id": "ETK-2026-934",
  "cve_id": "CVE-2026-94670",
  "display_id": "CVE-2026-94670",
  "ghsa_id": "GHSA-w525-c4vq-qxjw",
  "euvd_id": "EUVD-2026-94487",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Reflected cross-site scripting in Everest Forms",
  "summary": "Everest Forms versions through 3.6.1 are affected by a reflected cross-site scripting flaw. An attacker may cause script to run in a victim's browser in the context of an affected site if the victim interacts with attacker-controlled input.",
  "mitigation": "Disable Everest Forms or restrict access to pages using its forms where practical until an updated release is confirmed by the vendor. Apply the vendor's fixed update when it is available.",
  "vendor": "Everest Forms",
  "product": "Everest Forms",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 3.6.1"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "everest-forms",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
  "epss_score": 0.0015,
  "epss_percentile": 0.035,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 37.09758528333333,
  "t0_at": "2026-10-07T16:57:43.166000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-08T05:26:28.912492+00:00",
      "days": 0.5199739177314815,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T16:57:43.166000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T16:57:43.166000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T16:57:43.166000+00:00",
      "url": "https://github.com/advisories/GHSA-w525-c4vq-qxjw"
    }
  }
}