Stored Cross-Site Scripting Vulnerability in SureForms Plugin for WordPress
CVE-2025-14855
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 December 2025
What is CVE-2025-14855?
The SureForms plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to exploit insufficient input sanitization and output escaping. By injecting arbitrary web scripts into form field parameters, attackers can run malicious scripts whenever a user accesses an affected page, posing a significant risk to user data and site integrity. All versions up to and including 2.2.0 are impacted, necessitating immediate action to secure vulnerable installations.
Affected Version(s)
SureForms – Contact Form, Payment Form & Other Custom Form Builder * <= 2.2.0