# CVE-2026-7623: Brainstorm Force SureForms stored XSS in headingWrapper parameter Source: https://junglewise.ai/threats/cve-2026-7623-brainstorm-force-sureforms-stored-xss-in-headingwrapper-parameter Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-08-01. Updated: 2026-08-01 License: CC BY 4.0 with a link back CVE-2026-7623 · Severity: medium · CVSS 6.4 · Published 2026-08-01 SureForms is a WordPress plugin used to create contact forms, payment forms, and surveys. A security vulnerability in this plugin allows users with basic contributor-level access to inject malicious scripts into website pages. If exploited, these scripts will run automatically whenever a visitor views the affected page, potentially leading to unauthorized actions or data theft. Technologies: [Brainstorm Force SureForms](https://junglewise.ai/threats/technologies/sureforms). Vendors: [Brainstorm Force](https://junglewise.ai/threats/vendors/brainstorm-force). ## Quick answers **Is CVE-2026-7623 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7623 being exploited in the wild. **How severe is CVE-2026-7623?** Medium severity, with a CVSS score of 6.4, published 1 August 2026. **Which products and versions are affected?** Brainstorm Force SureForms up to, and including, 2.8.1. **Is there a fix for CVE-2026-7623?** A patch was published on 2026-07-31: Version 2.8.2 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-7623 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-7623?** Check whether you run Brainstorm Force SureForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'headingWrapper' parameter within the Advanced Heading block. The vulnerability exists in all versions up to and including 2.8.1. An authenticated attacker with at least contributor-level permissions can inject arbitrary JavaScript into a page. This script executes in the context of any user (including administrators) who subsequently visits the compromised page. The issue was addressed in version 2.8.2 by improving sanitization within the Gutenberg block distribution files. ## Affected products - Brainstorm Force SureForms – Contact Form, Payment Form & Other Custom Form Builder up to, and including, 2.8.1 ## Timeline - 2026-07-31: disclosed: Vulnerability reported by Wordfence - 2026-07-31: patched: Version 2.8.2 released to address the issue - 2026-08-01: advisory: NVD publication date ## References - [https://plugins.trac.wordpress.org/browser/sureforms/tags/2.5.1/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php](https://plugins.trac.wordpress.org/browser/sureforms/tags/2.5.1/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php) - [https://plugins.trac.wordpress.org/browser/sureforms/tags/2.5.1/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php](https://plugins.trac.wordpress.org/browser/sureforms/tags/2.5.1/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php) - [https://plugins.trac.wordpress.org/browser/sureforms/tags/2.8.1/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php](https://plugins.trac.wordpress.org/browser/sureforms/tags/2.8.1/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php) - [https://plugins.trac.wordpress.org/browser/sureforms/tags/2.8.1/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php](https://plugins.trac.wordpress.org/browser/sureforms/tags/2.8.1/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php) - [https://plugins.trac.wordpress.org/browser/sureforms/trunk/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php](https://plugins.trac.wordpress.org/browser/sureforms/trunk/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php) - [https://plugins.trac.wordpress.org/browser/sureforms/trunk/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php](https://plugins.trac.wordpress.org/browser/sureforms/trunk/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php) - [https://plugins.trac.wordpress.org/changeset/3523295/sureforms/tags/2.8.2/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php](https://plugins.trac.wordpress.org/changeset/3523295/sureforms/tags/2.8.2/modules/gutenberg/dist/blocks/advanced-heading/class-advanced-heading.php) ## Related threats - [Brainstorm Force SureForms broken access control](https://junglewise.ai/threats/cve-2026-125763-missing-authorization-vulnerability-in-brainstorm-force) - [Brainstorm Force SureForms broken access control](https://junglewise.ai/threats/cve-2026-120842-missing-authorization-vulnerability-in-brainstorm-force) - [Brainstorm Force SureForms broken access control vulnerability](https://junglewise.ai/threats/cve-2026-116387-missing-authorization-vulnerability-in-brainstorm-force) - [Brainstorm Force SureForms content injection via XSS](https://junglewise.ai/threats/cve-2026-116402-improper-neutralization-of-script-related-html-tags-in-a-web) - [Brainstorm Force SureForms stored cross-site scripting](https://junglewise.ai/threats/cve-2026-108495-improper-neutralization-of-input-during-web-page-generation)