WordPress Plugin Vulnerabilities

SureForms < 2.12.3 - Unauthenticated Stored XSS via Text Field Entity-Encoded Payload

Description

The plugin is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
sureforms
Fixed in 2.12.3

References

CVE
CVE-2026-18406
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8583c1f2-0820-492c-9fa1-d96e0ce2ddf2

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
6ef2dda9-af4f-4a04-935a-3579f1477fbf

Timeline

Publicly Published
2026-09-04 (about 1 month ago)
Added
2026-09-04 (about 1 month ago)
Last Updated
2026-10-16 (about 8 hours ago)

Other

Published
Title
Published
2025-01-03
Title
WP jQuery DataTable < 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-08-28
Title
Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter
Published
2026-01-08
Title
SlimStat Analytics < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter
Published
2025-01-16
Title
Browser-Update-Notify <= 0.2.1 - Reflected Cross-Site Scripting
Published
2025-09-05
Title
Boxed Content <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting