CVE-2026-91153 Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...

CVE-2026-91153

The Everest Forms WordPress plugin (versions up to and including 3.6.2 ) is vulnerable to Sensitive Information Exposure due to a Smart-Tag Injection flaw. Unauthenticated attackers can extract arbitrary WordPress post meta values , such as license keys, API tokens, SMTP credentials, and Stripe o...