CVE-2026-108495: WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation can be performed over the network with low attack complexity, but requires low-level privileges and user interaction.

Q: What is the expected security impact if exploitation succeeds?

The CVSS assessment rates confidentiality, integrity, and availability impact as low. It also indicates a changed scope, meaning the vulnerable component can affect resources beyond its own security authority.

Published Oct 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.

Affected Software

1 affected component

Brainstorm Force SureForms<=2.12.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress SureForms plugin to a version that resolves this vulnerability.
Fixed in 2.12.8

Event History

Oct 13, 2026

CVE Published

via MITRE·08:30 AM

Data Sourced

via MITRE·08:30 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation can be performed over the network with low attack complexity, but requires low-level privileges and user interaction.

What is the expected security impact if exploitation succeeds?