CVE-2025-3513

The SureForms WordPress plugin in versions prior to 1.4.4 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain Form settings . This vulnerability allows high-privilege users, such as administrators, to perform XSS attacks even ...

CVE-2025-3471

The SureForms WordPress plugin, in versions prior to 1.4.4 , is vulnerable to an authorization bypass when updating settings via the REST API . The root cause is a lack of proper authorization checks, which could allow users with Contributor roles and above to perform restricted administrative ac...

CVE-2025-3514

The SureForms WordPress plugin versions prior to 1.4.4 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape certain Form settings, which allows high-privilege users (such as administrators) to perform XSS attacks. This remains p...

CVE-2024-12713

CVE-2024-12713 affects the SureForms – Drag and Drop Form Builder for WordPress plugin. It exposes information via handle_export_form() due to a missing capability check, allowing unauthenticated export of data from password‑protected, private, or draft posts. Impact is information exposure (per ...

CVE-2025-6691

CVE-2025-6691 affects the WordPress plugin SureForms – Drag and Drop Form Builder (Brainstorm Force) up to version 1.7.3. The vulnerability arises from insufficient file path validation in the delete_entry_files() function, enabling unauthenticated attackers to delete arbitrary files on the serve...

CVE-2025-5921

The SureForms WordPress plugin (versions before 1.7.2 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. An attacker can exploit this by injecting a carefully crafted payloa...

CVE-2025-6742

Mode C: CVE-2025-6742 affects the WordPress plugin SureForms – Drag and Drop Form Builder for WordPress up to version 1.7.3. The root cause is use of file_exists() in delete_entry_files() with no path restriction, enabling unauthenticated PHP Object Injection. The report notes that no known POP c...