brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.

Check whether your brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder version is affected

Latest brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder vulnerabilities

CVE-2026-108495 — WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
CVE-2026-85308 — WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
CVE-2026-11567 — SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass (CVSS 5.9)
CVE-2026-4987 — SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' (CVSS 7.5)
CVE-2025-14855 — SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
CVE-2025-12535 — SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution (CVSS 5.3)
CVE-2025-12536 — SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3)
CVE-2025-10732 — SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure (CVSS 4.3)
CVE-2025-8282 — SureForms < 1.9.1 - Admin+ Stored XSS (CVSS 3.5)
CVE-2025-10489 — SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation (CVSS 4.3)
CVE-2025-5921 — SureForms < 1.7.2 - Reflected XSS (CVSS 5.8)
CVE-2025-6742 — SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion (CVSS 7.5)
CVE-2025-6691 — SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion (CVSS 8.1)
CVE-2025-3514 — SureForms < 1.4.4 - Admin+ Stored XSS (CVSS 3.5)
CVE-2025-3513 — SureForms < 1.4.4 - Admin+ Stored XSS (CVSS 3.5)
CVE-2025-3471 — SureForms < 1.4.4 - Contributor+ Settings Update (CVSS 4.9)
CVE-2024-12713 — SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure (CVSS 5.3)