PLUGIN SECURITY
Is Everest Forms safe?
AI form builder for WordPress. Build contact forms, payment forms, quiz, survey & conversational forms with built-in AI or drag & drop builder.
What this plugin does
- Slug:
everest-forms - Author: wpeverest
- 90000+ active installs
- 98/100 rating (375 reviews on wordpress.org)
- 7800323 all-time downloads
- On WordPress.org since 2018-02-02
contact formcustom formform builderformssurvey
Maintenance status
- Last updated: 2026-08-13 9:01am GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.2+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
17 known CVEs on file for Everest Forms.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-5096 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.4.5 | Server-Side Request Forgery (SSRF) | Medium 5.3 | < 3.4.5 | 3.4.5 | 2026-08-15 | — |
| CVE-2026-12270 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.5.0 | Missing Authorization | Unknown | < 3.5.0 | 3.5.0 | 2026-07-09 | — |
| CVE-2026-11571 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.5.0 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 3.5.0 | 3.5.0 | 2026-07-09 | — |
| CVE-2026-57312 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.5.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.5.0 | 3.5.0 | 2026-06-25 | — |
| CVE-2026-13167 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.5.3 | Missing Authorization | Medium 4.3 | < 3.5.3 | 3.5.3 | 2026-06-25 | — |
| CVE-2026-4888 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.4.8 | Missing Authorization | Medium 4.3 | < 3.4.8 | 3.4.8 | 2026-05-27 | — |
| CVE-2026-5478 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.4.5 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 8.1 | < 3.4.5 | 3.4.5 | 2026-04-20 | — |
| CVE-2026-22422 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.4.2 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Medium 5.3 | < 3.4.2 | 3.4.2 | 2025-09-26 | — |
+ 15 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-52709 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.2.3 | Deserialization of Untrusted Data | Critical 9.8 | < 3.2.3 | 3.2.3 | 2025-06-27 | — |
| CVE-2025-26841 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.0.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.0.9 | 3.0.9 | 2025-05-12 | — |
| CVE-2024-13125 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.0.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Low 3.5 | < 3.0.8.1 | 3.0.8.1 | 2025-01-17 | — |
| CVE-2024-10471 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.0.4.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.0.4.2 | 3.0.4.2 | 2024-11-05 | — |
| CVE-2024-1812 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 2.0.8 | Server-Side Request Forgery (SSRF) | High 7.2 | < 2.0.8 | 2.0.8 | 2024-03-15 | — |
| CVE-2023-51695 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 2.0.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 2.0.5 | 2.0.5 | 2023-12-27 | — |
| CVE-2023-51377 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 2.0.3.1 | Missing Authorization | Medium 5.3 | < 2.0.3.1 | 2.0.3.1 | 2023-12-26 | — |
| CVE-2021-24907 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 1.8.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.8.0 | 1.8.0 | 2021-11-22 | — |
| CVE-2019-13575 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 1.5.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 1.5.0 | 1.5.0 | 2019-07-18 | — |
| — | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.0.3.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.0.3.1 | 3.0.3.1 | 0000-00-00 | — |
| — | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.0.9.5 | Unrestricted Upload of File with Dangerous Type | Critical 9.8 | < 3.0.9.5 | 3.0.9.5 | 0000-00-00 | — |
| — | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.1.2 | Deserialization of Untrusted Data | Critical 9.8 | < 3.1.2 | 3.1.2 | 0000-00-00 | — |
| — | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.1.2 | Improper Control of Generation of Code ('Code Injection') | Medium 6.3 | < 3.1.2 | 3.1.2 | 0000-00-00 | — |
| — | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.1.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.1.2 | 3.1.2 | 0000-00-00 | — |
| — | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms] < 3.4.4 | — | Unknown | < 3.4.4 | 3.4.4 | 0000-00-00 | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Contact Form 7 — 10000000+ active installs — 80/100 (2178) — max PHP 8.4
- Akismet Anti-spam: Spam Protection — 5000000+ active installs — 94/100 (1186) — max PHP 8.4
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs — 96/100 (14368)
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 700000+ active installs — 96/100 (789)
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ active installs — 96/100 (2113)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.