Stored Cross-Site Scripting Vulnerability in SureForms Contact Form Builder for WordPress
CVE-2026-18406

7.2HIGH

Key Information:

Vendor

WordPress
Status
Sureforms – Contact Form Builder, Ai Forms, Payment Form, Survey & Quiz
Vendor
CVE Published:
5 September 2026

What is CVE-2026-18406?

The SureForms plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. Attackers can exploit this vulnerability by injecting harmful web scripts that will execute when users access compromised pages. This affects all versions of the plugin up to and including 2.12.2, allowing unauthorized users to manipulate form fields and potentially compromise site security and user data.

Affected Version(s)

SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz 0 <= 2.12.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/sureforms/tags...
https://plugins.trac.wordpress.org/browser/sureforms/tags...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo
.