SureForms <= 1.13.1 - Sensitive Information Exposure

SureForms WordPress plugin = 1.13.1 contains a sensitive information exposure caused by setting 'authcallback' to 'returntrue' in 'srfmemailnotification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication. id:...

SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id

The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2. The createpaymentintent AJAX handler checks if $formid 0 && !empty$blockid before calling validatepaymentamount. By sending formid=0 the default intval of a missing/zero...

CVE-2025-14855-POC

CVE-2025-14855: SureForms WordPress Plugin Stored XSS Proof of Concept Target: WordPress Plugin "SureForms" Plugin Wordpress: https://wordpress.org/plugins/sureforms/ Vulnerability Type: Stored Cross-Site Scripting XSS CVE: CVE-2025-14855 Refer:...

CVE-2026-19500-poc

CVE-2026-19500 Poc and writeup Description Sureforms is vulnerable to a DOS vulnerability , when attacker can submit unlimited key-value pair, leads to resource exhaustion and the administrator can not watch entries temporary. How to reproduce Submit the Form which is made by Sureforms plugin, an...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2026-116387

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9...

EUVD-2026-112867

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9...

CVE-2026-116387 WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9...

CVE-2026-116387 WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9...

CVE-2026-116387

The WordPress SureForms plugin (versions ↔ 2.12.9 ) is affected by a Missing Authorization vulnerability (CWE-862 ). This Broken Access Control flaw allows for the exploitation of incorrectly configured access control security levels. The vulnerability's base CVSS score is 5.3 (Medium) , with a n...

WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Luke Schneider in WordPress Plugin SureForms versions = 2.12.9...

CVE-2026-116402

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9...

EUVD-2026-112917

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9...

CVE-2026-116402 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9...

CVE-2026-116402

The Brainstorm Force SureForms WordPress plugin (versions

WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

Content Injection vulnerability discovered by Filip Kowalski in WordPress Plugin SureForms versions = 2.12.9...

PT-2026-132184

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9...

WordPress SureForms authorization issue vulnerability

WordPress SureForms versions 2.12.9 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation, enabling exploitation of improperly configured access control security levels...

WordPress SureForms cross-site scripting vulnerability

WordPress SureForms versions 2.12.9 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper handling of script-related HTML tags, potentially leading to code injection...

CVE-2026-116402: Brainstorm Force SureForms: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force…

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9...