Brainstorm Force SureForms vulnerabilities

Latest Brainstorm Force SureForms CVEs

Newest publication first

1. CVE-2026-125763 WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

   Published 2026-11-11

   Medium·CVSS 5.3 EPSS 0.28%

   Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

2. CVE-2026-120842 WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.27%

   Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

3. CVE-2026-116387 WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

   Published 2026-10-29

   Medium·CVSS 5.3 EPSS 0.18%

   Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.

4. CVE-2026-116402 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

   Published 2026-10-29

   Medium·CVSS 5.3 EPSS 0.30%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.

5. CVE-2026-108495 WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-13

   Medium·CVSS 6.5 EPSS 0.14%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.

6. CVE-2026-85308 WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-09-03

   Medium·CVSS 5.3 EPSS 0.34%

   Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.