5.8
Medium
CVE-2025-5921 The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the…
Description
The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SureForms 1.7 | earliest → < 1.7.2 | 1.7.2 |
Other CVEs of SureForms
The 6 CVEs of SureForms →
CVE-2026-11567
The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a…
5.9
Medium
CVE-2025-8282
The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the…
3.5
Low
CVE-2025-3513
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow…
3.5
Low
CVE-2025-3514
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow…
3.5
Low