SureForms vulnerabilities
4 known CVE vulnerabilities in SureForms, translated and rated.
- CVE-2026-19500High
The Entries component in Brainstorm Force SureForms versions less than 2.12.3 does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, allowing a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.
- CVE-2026-7623Medium
The SureForms plugin for WordPress up to version 2.8.1 has a Stored Cross-Site Scripting vulnerability via the 'headingWrapper' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts.
- CVE-2026-11567Medium
The SureForms WordPress plugin before version 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
- CVE-2026-15288High
The SureForms plugin for WordPress up to version 2.2.1 has an improper input validation vulnerability. The 'create_payment_intent' and 'create_subscription_intent' functions accept payment amounts directly from POST data without validating against the form's configured price, allowing unauthenticated attackers to modify the payment amount.