An unauthenticated Stored Cross-Site Scripting vulnerability in the SureForms WordPress plugin (up to 2.12.2) allows attackers to inject malicious scripts that execute in victim browsers.
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
web-application
xss
wordpress
cve-2026-18406
1t
1c