CVE-2026-108495
6.5MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Authenticated attackers can inject malicious scripts that execute in the context of other users or administrators. They need low-privilege network access to submit data and an admin or user to view the affected page.
Root cause
The plugin fails to sanitize user input before storing it and rendering it into web pages, enabling stored cross-site scripting.
Affected systems
Brainstorm Force SureForms through version 2.12.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade SureForms to a version past 2.12.7 once available. If a patched release is not yet out, deactivate the SureForms plugin via the WordPress admin panel or CLI.
$ wp plugin update sureformsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.