SureForms – Drag and Drop Form Builder for WordPress

Уязвимости

• CVE-2025-6691

  SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion

  Высокий 8.1

• CVE-2026-15288

  SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation

  Высокий 7.5

• CVE-2026-4987

  SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'

  Высокий 7.5

• CVE-2025-6742

  SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion

  Высокий 7.5

• CVE-2026-18406

  SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload

  Высокий 7.2

• CVE-2025-14855

  SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

  Высокий 7.2

• CVE-2026-7623

  SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute

  Средний 6.4

• CVE-2026-85308

  WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability

  Средний 5.3

• CVE-2025-12535

  SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution

  Средний 5.3

• CVE-2025-12536

  SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure

  Средний 5.3

• CVE-2024-12713

  SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure

  Средний 5.3

• CVE-2025-10732

  SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure

  Средний 4.3

• CVE-2025-10489

  SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation

  Средний 4.3