Plugin icon

SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

sureforms

Vulnerabilities:

36

Last Updated:

September 25, 2026

Active Installs:

500000

Published
Title
Fixed in
CVSS
Published
2026-09-04
Title
SureForms < 2.12.3 - Unauthenticated Stored XSS via Text Field Entity-Encoded Payload
Fixed in
Fixed in 2.12.3
CVSS
7.2 (high)
Published
2026-09-03
Title
SureForms < 2.12.6 - Unauthenticated IDOR
Fixed in
Fixed in 2.12.6
CVSS
5.3 (medium)
Published
2026-07-31
Title
SureForms < 2.8.2 - Contributor+ Stored XSS via 'headingWrapper' Block Attribute
Fixed in
Fixed in 2.8.2
CVSS
5.5 (medium)
Published
2026-06-23
Title
SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass
Fixed in
Fixed in 2.11.1
CVSS
5.9 (medium)
Published
2026-03-27
Title
SureForms < 2.6.0 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
Fixed in
Fixed in 2.6.0
CVSS
7.5 (high)
Published
2026-02-15
Title
SureForms < 2.2.2 - Missing Authorization
Fixed in
Fixed in 2.2.2
CVSS
5.3 (medium)
Published
2026-02-13
Title
SureForms < 2.2.2 - Unauthenticated Stripe Payment Amount Manipulation
Fixed in
Fixed in 2.2.2
CVSS
7.5 (high)
Published
2025-12-20
Title
SureForms < 2.2.1 - Unauthenticated Stored XSS
Fixed in
Fixed in 2.2.1
CVSS
7.2 (high)
Published
2025-11-18
Title
SureForms < 1.13.2 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
Fixed in
Fixed in 1.13.2
CVSS
5.3 (medium)
Published
2025-11-12
Title
SureForms < 1.13.2 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 1.13.2
CVSS
5.3 (medium)
Published
2025-10-13
Title
SureForms – Drag and Drop Form Builder for WordPress < 1.12.2 - Missing Authorization to Authenticated (Contributor+) Information Disclosure
Fixed in
Fixed in 1.12.2
CVSS
4.3 (medium)
Published
2025-09-19
Title
SureForms – Drag and Drop Form Builder for WordPress < 1.12.1 - Missing Authorization to Authenticated (Contributor+) Form Creation
Fixed in
Fixed in 1.12.1
CVSS
4.3 (medium)
Published
2025-09-02
Title
SureForms < 1.9.1 - Admin+ Stored XSS
Fixed in
Fixed in 1.9.1
CVSS
3.5 (low)
Published
2025-07-11
Title
SureForms < 1.7.2 - Reflected XSS
Fixed in
Fixed in 1.7.2
CVSS
5.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 1.3.2
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.4.5
CVSS
7.5 (high)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.7.4
CVSS
7.5 (high)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 1.5.1
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.6.5
CVSS
7.5 (high)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 0.0.14
CVSS
7.5 (high)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 1.0.7
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.1.2
CVSS
7.5 (high)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 1.2.5
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.3.2
CVSS
7.5 (high)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 1.4.5
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.5.1
CVSS
7.5 (high)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 1.7.4
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 1.6.5
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 0.0.14
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.0.7
CVSS
7.5 (high)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 1.1.2
CVSS
6.8 (medium)
Published
2025-07-08
Title
SureForms < 1.7.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 1.2.5
CVSS
7.5 (high)
Published
2025-04-11
Title
SureForms < 1.4.4 - Admin+ Stored XSS
Fixed in
Fixed in 1.4.4
CVSS
3.5 (low)
Published
2025-04-11
Title
SureForms < 1.4.4 - Admin+ Stored XSS
Fixed in
Fixed in 1.4.4
CVSS
3.5 (low)
Published
2025-04-09
Title
SureForms < 1.4.4 - Contributor+ Settings Update
Fixed in
Fixed in 1.4.4
CVSS
4.9 (medium)
Published
2025-01-07
Title
SureForms – Drag and Drop Form Builder for WordPress < 1.2.3 - Missing Authorization to Unauthenticated Protected Post Disclosure
Fixed in
Fixed in 1.2.3
CVSS
5.3 (medium)