Sureforms (Unknown) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-07-14. Vendor: Unknown.

CVEs of Sureforms

• CVE-2026-11567 - CVSS 5.9 (medium), 2026-07-14: The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment…
• CVE-2025-8282 - CVSS 3.5 (low), 2025-09-23: The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above…
• CVE-2025-5921 - CVSS 5.8 (medium), 2025-08-01: The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site…
• CVE-2025-3514 - CVSS 3.5 (low), 2025-05-02: The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to…
• CVE-2025-3513 - CVSS 3.5 (low), 2025-05-02: The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to…
• CVE-2025-3471 - CVSS 4.9 (medium), 2025-04-30: The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow…