Sureforms Contact Form Builder Ai Forms Payment Form Survey Quiz
Monthly
Stored Cross-Site Scripting in the SureForms plugin for WordPress (all versions up to and including 2.12.2) permits unauthenticated form submitters to embed persistent malicious scripts by bypassing sanitization with entity-encoded payloads in text fields. The injected payload executes in any visitor's or administrator's browser when they load an affected page, enabling session hijacking, cookie theft, or page defacement across any WordPress site running the vulnerable plugin version. Wordfence reported the issue and a fix was released in version 2.12.3.
Stored Cross-Site Scripting in the SureForms WordPress plugin (all versions through 2.8.1) allows authenticated contributors to inject persistent JavaScript payloads via the unsanitized 'headingWrapper' parameter in the Advanced Heading Gutenberg block. Any user who subsequently visits a page containing the injected block triggers script execution in their browser, creating a realistic path to admin session hijacking when site administrators review contributor-submitted content. No public exploit code has been identified at time of analysis, and a patch is available in version 2.8.2.
Stored Cross-Site Scripting in the SureForms plugin for WordPress (all versions up to and including 2.12.2) permits unauthenticated form submitters to embed persistent malicious scripts by bypassing sanitization with entity-encoded payloads in text fields. The injected payload executes in any visitor's or administrator's browser when they load an affected page, enabling session hijacking, cookie theft, or page defacement across any WordPress site running the vulnerable plugin version. Wordfence reported the issue and a fix was released in version 2.12.3.
Stored Cross-Site Scripting in the SureForms WordPress plugin (all versions through 2.8.1) allows authenticated contributors to inject persistent JavaScript payloads via the unsanitized 'headingWrapper' parameter in the Advanced Heading Gutenberg block. Any user who subsequently visits a page containing the injected block triggers script execution in their browser, creating a realistic path to admin session hijacking when site administrators review contributor-submitted content. No public exploit code has been identified at time of analysis, and a patch is available in version 2.8.2.