SureForms EUVD-2026-51686

Exploitation requires an authenticated WordPress user account with contributor-level access or higher (confirmed by CVSS PR:L). The attacker must have permission to create or edit posts and pages using the SureForms Advanced Heading Gutenberg block - specifically, they must be able to set the 'headingWrapper' block attribute. Sites that have SureForms installed but do not use the Advanced Heading block in contributor-editable contexts are not exposed via this specific parameter. Exploitation is further bounded by the requirement that a victim user must visit the page containing the injected block for payload execution, making impact dependent on site traffic patterns and whether privileged users review contributor content. Factors limiting exploitation: contributor-role user accounts must exist on the site (many production WordPress sites disable open contributor registration); the SureForms plugin must be installed and active with the Advanced Heading block in use; and payload execution depends on victim page visits rather than being fully autonomous.

The provided CVSS score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects medium severity, but the UI:N rating warrants scrutiny - stored XSS requires a victim to actively visit the injected page, which aligns with UI:R under standard CVSS 3.1 conventions; this would lower the effective score to approximately 5.4. No EPSS data was provided, and this CVE does not appear in CISA KEV, so active exploitation is unconfirmed. Real-world risk is moderate but context-dependent: the authentication barrier (contributor-level) limits the attack surface to sites that allow untrusted contributors, while the scope change (S:C) elevates impact because a contributor-planted payload targeting an administrator's session can yield full site compromise. Sites with tightly controlled contributor rosters face meaningfully lower risk than those with open contributor registration. No public exploit has been identified, but the vulnerability is straightforward to exploit for anyone with valid contributor credentials.

An attacker registers or compromises a contributor-level WordPress account, then creates or edits a post containing a SureForms Advanced Heading block and sets the 'headingWrapper' parameter to a JavaScript payload designed to exfiltrate the visitor's session cookie to an attacker-controlled endpoint. When a WordPress administrator subsequently visits the page to review or approve the content, the script executes silently in their browser, transmitting the admin session token and allowing the attacker to take full control of the WordPress site. No public proof-of-concept exploit code has been identified at time of analysis.