CVE-2025-3514: SureForms < 1.4.4 - Admin+ Stored XSS
Published May 2, 2025
·Updated
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
2 affected components
SureForms WordPress plugin<1.4.4
Brainstormforce Sureforms Wordpress<1.4.4
Event History
May 2, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2025-3514?
CVE-2025-3514 is classified as a high severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
2
How do I fix CVE-2025-3514?
To fix CVE-2025-3514, update the SureForms WordPress plugin to version 1.4.4 or later.
3
Who is affected by CVE-2025-3514?
CVE-2025-3514 affects installations of the SureForms WordPress plugin before version 1.4.4.
4
What type of vulnerability is CVE-2025-3514?
CVE-2025-3514 is a Stored Cross-Site Scripting (XSS) vulnerability.
5
Can admin users exploit CVE-2025-3514?
Yes, high privilege users, such as admins, can exploit CVE-2025-3514 to perform attacks.