Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Security & Risk Analysis

Everest Forms v3.4.3 exhibits a mixed security posture. While the plugin demonstrates good practices with a high percentage of prepared SQL statements and proper output escaping, there are notable areas of concern. The presence of the 'unserialize' function is a red flag, especially when combined with 11 taint flows flagged as having unsanitized paths and 4 identified as high severity. This combination suggests a potential for deserialization vulnerabilities that could lead to code execution or other critical impacts if user-supplied data reaches these functions without proper sanitization. The plugin's history of 12 known CVEs, including critical and high severity issues like deserialization, code injection, and XSS, further amplifies these concerns, even though none are currently unpatched. This pattern indicates a recurring struggle with securing sensitive operations and handling user input, demanding vigilance from users and developers alike. In conclusion, while the plugin has a substantial attack surface and some positive security hygiene, the identified taint flow issues and historical vulnerability trends necessitate careful consideration of its security.