{"id":"CVE-2026-116402","kind":"vulnerability","aliases":["CVE-2026-116402"],"related":[],"title":"SureForms WordPress plugin: stored script injection through forms, up to 2.12.9","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.","summary":"SureForms, a WordPress form-builder plugin by Brainstorm Force, fails to neutralize script-related HTML tags on some web pages. An attacker can inject script that runs in other visitors' browsers, and the sources do not state whether an account is needed.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","sureforms","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed SureForms version in the WordPress admin under Plugins; affected versions are listed as `2.12.9` and earlier.","fix":"- SureForms versions after `2.12.9` (the sources do not name the fixed version)","status":"open","published_at":"2026-10-29T14:17:50+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:09+00:00","updated_at":"2026-10-29T14:26:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T14:26:09Z","model":"claude-haiku-5-5","output":{"fix":"- SureForms versions after `2.12.9` (the sources do not name the fixed version)\n- unknown","reach":"internet","title":"SureForms WordPress plugin: stored script injection through forms, up to 2.12.9","impact":"medium","summary":"SureForms, a WordPress form-builder plugin by Brainstorm Force, fails to neutralize script-related HTML tags on some web pages. An attacker can inject script that runs in other visitors' browsers, and the sources do not state whether an account is needed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","sureforms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers on the affected site","analyst_note":"Find the vendor advisory or a fixed SureForms version and confirm the trigger conditions (auth, form type) from the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-116402.","how_to_check":"- Check the installed SureForms version in the WordPress admin under Plugins; affected versions are listed as `2.12.9` and earlier.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SureForms WordPress plugin at version 2.12.9 or earlier are in the stated range. The sources do not say which forms, pages or settings are needed to trigger it, or whether logged-in users are required, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":4123,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116402':14A,17A '-2026':13A,16A '2.12.9':11A,94C 'account':62B 'affect':89C 'allow':85C 'attack':44B 'basic':77C 'brainstorm':29B,81C 'browser':53B 'builder':26B 'code':86C 'cve':12A,15A 'fail':31B 'forc':30B,82C 'form':8A,25B 'form-build':24B 'html':37B,71C 'improp':65C 'inject':6A,46B 'injection.this':87C 'issu':88C 'n/a':92C 'need':64B 'neutral':33B,66C 'packag':18B 'page':42B,76C 'plugin':3A,27B 'relat':36B,70C 'run':49B 'script':5A,35B,47B,69C 'script-rel':34B,68C 'sourc':56B 'state':59B 'store':4A 'sureform':1A,19B,21B,83C,84C,90C 'tag':38B,72C 'visitor':52B 'vulner':79C 'web':41B,75C 'whether':60B 'wordpress':2A,20B,23B 'xss':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureForms WordPress plugin at version 2.12.9 or earlier are in the stated range. The sources do not say which forms, pages or settings are needed to trigger it, or whether logged-in users are required, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116402","severity":null,"published_at":"2026-10-29T14:17:50+00:00","modified_at":"2026-10-29T14:17:50+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}