CVE-2025-8282

The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.

Score

CVSS 3.1 3.5 Low

Status

Deferred - contact@wpscan.com

Published

2025-09-23

Last modified

2026-10-11

Affected products

• Sureforms (Unknown)

References

• https://wpscan.com/vulnerability/62680106-1313-4ef0-80a5-33e93b4221a1/