CVE-2025-3514

The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-3514

creationtimestamp| type| source ---|---|--- 2025-05-02 06:15:13+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14442 2025-05-02 08:00:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo6e7paniy2e 2025-05-02 09:15:13+00:00| seen| https://t.me/cvedetector/24332...

CVE-2025-3514 SureForms < 1.4.4 - Admin+ Stored XSS

The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...