CVE-2025-8282: SureForms < 1.9.1 - Admin+ Stored XSS
Published Sep 23, 2025
·Updated
The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.
Affected Software
1 affected component
SureForms SureForms Plugin<1.9.1
Event History
Sep 23, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2025-8282?
CVE-2025-8282 has a medium severity due to its potential for Cross-Site Scripting attacks affecting admin and higher-privileged users.
2
How do I fix CVE-2025-8282?
To fix CVE-2025-8282, upgrade the SureForms WordPress plugin to version 1.9.1 or later.
3
Who is affected by CVE-2025-8282?
Admins and higher-privileged users of the SureForms WordPress plugin prior to version 1.9.1 are affected by CVE-2025-8282.
4
What type of vulnerability is CVE-2025-8282?
CVE-2025-8282 is a Cross-Site Scripting (XSS) vulnerability.
5
What parameters are not sanitized in CVE-2025-8282?
CVE-2025-8282 does not sanitize and escape certain parameters when outputting them on the page.