Executive brief
SureForms is a popular WordPress plugin used to create contact forms, surveys, quizzes, and payment forms on websites. The plugin fails to properly sanitize and escape user input in text fields, allowing attackers without authentication to inject malicious scripts that execute whenever any website visitor views a page containing an injected form. This could be used to steal visitor credentials, redirect users to malicious sites, or compromise the website's reputation.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw affecting SureForms versions up to 2.12.2. The plugin does not properly sanitize and escape input from text field elements, even when payloads use entity encoding to bypass basic filters. An unauthenticated attacker can inject arbitrary JavaScript code through form submissions, which is then stored and executed in the browsers of all users who subsequently view the affected form or page. The vulnerability exists in form submission handling (form-submit.php) and requires only that a form exists on a publicly accessible page; no user authentication is required to trigger the vulnerability or for attackers to inject payloads.
Affected products
- SureForms SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz up to and including 2.12.2
Timeline
- 2026-09-05: disclosed