Brainstormforce Sureforms vulnerabilities

• brainstormforce sureforms – contact form builder, ai forms, payment form, survey & quiz SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload CVE-2026-18406 7.2 HighSeptember 5, 2026
• brainstormforce sureforms – contact form builder, ai forms, payment form, survey & quiz SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute CVE-2026-7623 6.4 MediumAugust 1, 2026
• brainstormforce sureforms – drag & drop contact form & form builder, payment form, survey, quiz & calculator SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation CVE-2026-15288 7.5 HighJuly 10, 2026
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' CVE-2026-4987 7.5 HighMarch 28, 2026
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting CVE-2025-14855 Public exploit 7.2 HighDecember 21, 2025
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution CVE-2025-12535 5.3 MediumNovember 19, 2025
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVE-2025-12536 5.3 MediumNovember 13, 2025
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure CVE-2025-10732 4.3 MediumOctober 14, 2025
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation CVE-2025-10489 4.3 MediumSeptember 20, 2025
• brainstormforce sureforms SureForms < 1.7.2 - Reflected XSS CVE-2025-5921 5.8 MediumAugust 1, 2025
• brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 more SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion CVE-2025-6742 7.5 HighJuly 9, 2025
• brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 more SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion CVE-2025-6691 8.1 HighJuly 9, 2025
• brainstormforce sureforms SureForms < 1.4.4 - Admin+ Stored XSS CVE-2025-3514 3.5 LowMay 2, 2025
• brainstormforce sureforms SureForms < 1.4.4 - Admin+ Stored XSS CVE-2025-3513 3.5 LowMay 2, 2025
• brainstormforce sureforms SureForms < 1.4.4 - Contributor+ Settings Update CVE-2025-3471 4.9 MediumApril 30, 2025
• brainstormforce sureforms, sureforms – contact form, payment form & other custom form builder +1 more SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure CVE-2024-12713 5.3 MediumJanuary 8, 2025