SureForms – Drag and Drop Form Builder for

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 2.12.9.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The vector marks UI:N, but the narrative’s victim viewing or interaction requirement still applies. The structured affected range is <= 2.12.9.

Attacker-controlled input is stored and later rendered without sufficient neutralization, allowing injected script to execute when a victim views the affected output. The CNA vector requires low privileges and victim interaction. The export does not name the minimum WordPress role, endpoint, input field, rendering function or victim role; an administrator-specific path is not established. Affected versions: <= 2.12.7. The authoritative export identifies 2.12.8 as fixed for this CVE.

SureForms through 2.12.2 does not safely normalize and escape an entity-encoded payload submitted through a public text field. An unauthenticated form submitter can store script that executes when a user views the affected entry or page.

SureForms through 2.12.5 relies on a user-controlled key for authorization. An unauthenticated requester can bypass the intended object-access boundary and retrieve protected information.

SureForms through 2.8.1 does not adequately sanitize and escape the headingWrapper parameter used by its advanced-heading block. A Contributor-or-higher user can save attacker-controlled markup in a page through that parameter, and the block renderer places the value into the page without sufficient output escaping. The injected JavaScript executes whenever a visitor or administrator views the affected page. The published.

SureForms is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 2.11.1.

SureForms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

SureForms is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

SureForms is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.

SureForms – Drag and Drop Form Builder for is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller.

SureForms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

SureForms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

SureForms – Drag and Drop Form Builder for is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

SureForms – Drag and Drop Form Builder for is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

SureForms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

SureForms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

SureForms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

SureForms – Drag and Drop Form Builder for is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.