CVE-2026-91153 Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-91153

The Everest Forms WordPress plugin (versions up to and including 3.6.2 ) is vulnerable to Sensitive Information Exposure due to a Smart-Tag Injection flaw. Unauthenticated attackers can extract arbitrary WordPress post meta values , such as license keys, API tokens, SMTP credentials, and Stripe o...

CVE-2026-91153 Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-91153 Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-101921

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-101921

The WPForms WordPress plugin (versions up to and including 2.0.2.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the 'query_var' Smart Tag parameter. An unauthenticated attacker can inject arbitrary web sc...

CVE-2026-101921 WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-101921 WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

EUVD-2026-96278

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

PT-2026-109595

Name of the Vulnerable Software and Affected Versions WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More versions prior to 2.0.2.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

CVE-2026-101921: Improper Neutralization of Input During Web Page Generation

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

EUVD-2026-86590

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 2.0.2 . The root cause is insufficient input sanitization and output escaping of the page_title POST parameter when processed via the {page_title} Smart Tag...

PT-2026-98387

Name of the Vulnerable Software and Affected Versions WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More versions prior to 2.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

VulnCheck KEV: CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996: Improper Neutralization of Input During Web Page Generation

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-86407: Exposure of Sensitive Information to an Unauthorized Actor

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...