SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

Information

Software Type Plugin
Software Slug sureforms (view on wordpress.org)
Software Status Active
Software Author brainstormforce
Software Website sureforms.com
Software Downloads 4,805,029
Software Active Installs 500,000
Software Record Last Updated August 12, 2026

18 Vulnerabilities

Submit a Vulnerability
SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute
6.4
CVE-2026-7623
Jul 31, 2026
Researcher: Dmitrii Ignatyev
SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass
5.3
CVE-2026-11567
Jun 23, 2026
Researcher: Yaswanth Reddy Sunkara
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
7.5
CVE-2026-4987
Mar 27, 2026
Researcher: AlexHenry
SureForms <= 2.2.1 - Missing Authorization
5.3
CVE ID Unknown
Feb 15, 2026
Researcher: andrea bocchetti
SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation
7.5
CVE-2026-15288
Feb 13, 2026
Researcher: andrea bocchetti
SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-14855
Dec 20, 2025
Researcher: Tiến Dũng Nguyễn
SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
5.3
CVE-2025-12535
Nov 18, 2025
Researcher: type5afe
SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
5.3
CVE-2025-12536
Nov 12, 2025
Researcher: type5afe
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure
4.3
CVE-2025-10732
Oct 13, 2025
Researcher: Abu Hurayra (HurayraIIT)
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation
4.3
CVE-2025-10489
Sep 19, 2025
Researcher: Alex
SureForms – Drag and Drop Form Builder for WordPress <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-8282
Sep 2, 2025
Researcher: Dmitrii Ignatyev
SureForms <= 1.7.1 - Reflected Cross-Site Scripting
6.1
CVE-2025-5921
Jul 11, 2025
Researcher: Dmitrii Ignatyev
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion
8.1
CVE-2025-6691
Jul 8, 2025
Researcher: Phat RiO
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion
7.5
CVE-2025-6742
Jul 8, 2025
Researcher: Phat RiO
SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-3514
Apr 11, 2025
Researcher: Dmitrii Ignatyev
SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2025-3513
Apr 11, 2025
Researcher: Dmitrii Ignatyev
SureForms – Drag and Drop Form Builder for WordPress <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Settings Update
4.3
CVE-2025-3471
Apr 9, 2025
Researcher: Dmitrii Ignatyev
SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure
5.3
CVE-2024-12713
Jan 7, 2025
Researcher: Lucio Sá
Title Status CVE ID CVSS Researchers Date
SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute Patched CVE-2026-7623 6.4 Dmitrii Ignatyev July 31, 2026
SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass Patched CVE-2026-11567 5.3 Yaswanth Reddy Sunkara June 23, 2026
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' Patched CVE-2026-4987 7.5 AlexHenry March 27, 2026
SureForms <= 2.2.1 - Missing Authorization Patched 5.3 andrea bocchetti February 15, 2026
SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation Patched CVE-2026-15288 7.5 andrea bocchetti February 13, 2026
SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-14855 7.2 Tiến Dũng Nguyễn December 20, 2025
SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution Patched CVE-2025-12535 5.3 type5afe November 18, 2025
SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure Patched CVE-2025-12536 5.3 type5afe November 12, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure Patched CVE-2025-10732 4.3 Abu Hurayra (HurayraIIT) October 13, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation Patched CVE-2025-10489 4.3 Alex September 19, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-8282 4.4 Dmitrii Ignatyev September 2, 2025
SureForms <= 1.7.1 - Reflected Cross-Site Scripting Patched CVE-2025-5921 6.1 Dmitrii Ignatyev July 11, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion Patched CVE-2025-6691 8.1 Phat RiO July 8, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion Patched CVE-2025-6742 7.5 Phat RiO July 8, 2025
SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2025-3514 4.4 Dmitrii Ignatyev April 11, 2025
SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2025-3513 4.4 Dmitrii Ignatyev April 11, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Settings Update Patched CVE-2025-3471 4.3 Dmitrii Ignatyev April 9, 2025
SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure Patched CVE-2024-12713 5.3 Lucio Sá January 7, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation