Search CVEs, research… / diras.sa

CVE-2026-18406: stored cross-site scripting in brainstormforce SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

An unauthenticated attacker can inject persistent JavaScript into pages served by the SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz WordPress plugin, enabling stored cross-site scripting (CWE-79). CVE-2026-18406 affects SureForms branch 2.x, specifically versions 2.12.2 and earlier. The flaw results from insufficient input sanitization and output escaping on text fields; an attacker only needs the ability to submit form input (no login required) and a victim to view the injected page to trigger the script.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
7.2HIGH
EPSS
0.00285
CWE
CWE-79
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: treat this as high priority because the flaw allows unauthenticated, persistent script injection into pages users visit. Immediately limit exposure and prepare to apply the vendor's fix when released.

What is CVE-2026-18406?

An unauthenticated attacker can inject persistent JavaScript into pages served by the SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz WordPress plugin, enabling stored cross-site scripting (CWE-79). CVE-2026-18406 affects SureForms branch 2.x, specifically versions 2.12.2 and earlier. The flaw results from insufficient input sanitization and output escaping on text fields; an attacker only needs the ability to submit form input (no login required) and a victim to view the injected page to trigger the script. The weakness is classified as CWE-79 (Cross-site Scripting).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Which versions of brainstormforce SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz are affected?

BRANCHAFFECTEDFIXED
2.x2.12.2 and earlier

Is CVE-2026-18406 being exploited?

There are no public reports of exploitation as of 2026-09-30.

How to fix CVE-2026-18406

  1. Remove or deactivate the SureForms plugin on internet-facing sites until a patched version is available.
  2. If removal is not possible, restrict access to affected form pages and reduce public exposure via authentication or IP restrictions.
  3. Monitor logs and web application firewalls for suspicious POST submissions and unexpected script content in stored form entries.
  4. Follow the vendor's guidance and apply the supplied patch as soon as a fixed version is released.

Frequently asked questions

Is CVE-2026-18406 being actively exploited?

There are no public reports of active exploitation of CVE-2026-18406 as of 2026-09-30.

Which SureForms versions are affected by CVE-2026-18406?

SureForms branch 2.x is affected; versions 2.12.2 and earlier are listed as vulnerable.

Is there a patch for CVE-2026-18406?

No fixed version is listed for CVE-2026-18406; apply mitigations and install the vendor's patch when it becomes available.

Does CVE-2026-18406 require authentication?

No, the vulnerability allows unauthenticated attackers to submit payloads that can be stored and later executed when a user views the injected page.

References