Live › vulnerability › CVE-2026-116402
SureForms, a WordPress form-builder plugin by Brainstorm Force, fails to neutralize script-related HTML tags on some web pages. An attacker can inject script that runs in other visitors' browsers, and the sources do not state whether an account is needed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Sites running the SureForms WordPress plugin at version 2.12.9 or earlier are in the stated range. The sources do not say which forms, pages or settings are needed to trigger it, or whether logged-in users are required, so unknown.
No product ranges from the sources yet.
2.12.9 and earlier.2.12.9 (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-116402")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.