WordPress security by component

SureForms

Plugin description

SureForms is a WordPress component with 13 published CVE records in this archive. The latest tracked vulnerability was published Jul 14, 2026; the highest CVE/CNA score is 8.1.

Plugin slug: sureforms

Latest vulnerability

CVE-2026-11567: SureForms: A security weakness

SureForms is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 2.11.1.

PublishedJul 14, 2026

Known safe version2.11.1

		Safe version
Jul 14, 2026	CVE-2026-11567 SureForms: A security weakness SureForms is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 2.11.1.	2.11.1	CVE5.9 NVDPending
Dec 21, 2025	CVE-2025-14855 SureForms: Cross-site scripting SureForms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2 NVDPending
Nov 19, 2025	CVE-2025-12535 SureForms: Cross-site request forgery SureForms is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.3 NVDPending
Nov 13, 2025	CVE-2025-12536 SureForms: Sensitive information exposure SureForms is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE5.3 NVDPending
Oct 14, 2025	CVE-2025-10732 SureForms – Drag and Drop Form Builder for: Sensitive information exposure SureForms – Drag and Drop Form Builder for is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE4.3 NVDPending
Sep 23, 2025	CVE-2025-8282 SureForms: Cross-site scripting SureForms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE3.5 NVDPending
Aug 01, 2025	CVE-2025-5921 SureForms: Cross-site scripting SureForms is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.8 NVDPending
Jul 09, 2025	CVE-2025-6742 SureForms – Drag and Drop Form Builder for: Code execution SureForms – Drag and Drop Form Builder for is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE7.5 NVDPending
Jul 09, 2025	CVE-2025-6691 SureForms – Drag and Drop Form Builder for: Code execution SureForms – Drag and Drop Form Builder for is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.1 NVDPending
May 02, 2025	CVE-2025-3514 SureForms: Cross-site scripting SureForms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE3.5 NVDPending
May 02, 2025	CVE-2025-3513 SureForms: Cross-site scripting SureForms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE3.5 NVDPending
Apr 30, 2025	CVE-2025-3471 SureForms: A security weakness SureForms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.9 NVDPending
Jan 08, 2025	CVE-2024-12713 SureForms – Drag and Drop Form Builder for: A security weakness SureForms – Drag and Drop Form Builder for is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending