Description

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T07:17:11.040Z",
  "pubdate": "2026-09-05T07:17:11.040Z",
  "executiveSummary": "The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability, present in all versions up to and including 2.12.2, stems from inadequate input sanitization and improper output escaping within the plugin's text field components.\nThe flaw allows unauthenticated remote attackers to inject malicious JavaScript payloads into the WordPress database via form submissions.\nWhen a victim, such as an administrator or privileged user, views the affected forms or entries in the WordPress dashboard, the injected script executes within the context of their session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, credential theft, and unauthorized redirection.\nAs the exploit requires no authentication and targets the application's data processing layer, it poses a significant risk to site integrity and administrative account security.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the SureForms plugin to correctly sanitize and encode user-supplied data submitted through its text fields before storing it in the database and subsequently rendering it in the browser.\nSpecifically, the plugin processes input without performing sufficient validation or using appropriate escaping functions, such as those provided by the WordPress Security API (e.g., esc_html() or wp_kses_post()), leading to the storage of raw HTML and JavaScript payloads.\nThe vulnerability follows a standard Stored XSS attack flow. First, an unauthenticated attacker identifies a public-facing form created with the vulnerable plugin. Second, the attacker crafts a malicious payload—typically containing script tags or event handlers—and submits this payload through a text field.\nBecause the input is processed without adequate security controls, the malicious code is persisted within the WordPress database. Finally, when an authenticated user (such as a site administrator) accesses the form entries via the WordPress backend, the application retrieves the stored data and injects the payload directly into the HTML document structure.\nAs the browser does not distinguish between legitimate content and the injected script, it executes the payload in the context of the victim's session.\nThis allows the attacker to leverage the victim's privileges to perform unauthorized actions, such as creating new administrative accounts, modifying site configuration, or exfiltrating sensitive cookies.\nThe vulnerability affects all plugin versions up to and including 2.12.2 and is accessible via any network connection reaching the form. The reliance on client-side execution makes this a persistent threat as long as the malicious data remains in the database. Successful exploitation does not require the attacker to have existing credentials, as the vector is the form submission process itself, which is designed to accept public input."
}