CVE-2026-116402: WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that exploitation can be performed remotely over the network without authentication or user interaction. The available data does not identify any additional conditions or affected form configurations.

Q: What is the likely impact of successful exploitation?

Successful exploitation may allow content or script-related HTML injection, with potential disclosure of limited information. The supplied severity vector indicates no integrity or availability impact.

Q: Which SureForms versions are affected?

SureForms versions through 2.12.9 are affected. The earliest affected version is not specified.

Published Oct 29, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress SureForms plugin to a version that resolves this vulnerability.
Fixed in 2.13.0

Event History

Oct 29, 2026

CVE Published

via MITRE·02:05 PM

Data Sourced

via MITRE·02:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that exploitation can be performed remotely over the network without authentication or user interaction. The available data does not identify any additional conditions or affected form configurations.

What is the likely impact of successful exploitation?

Successful exploitation may allow content or script-related HTML injection, with potential disclosure of limited information. The supplied severity vector indicates no integrity or availability impact.

Which SureForms versions are affected?