PLUGIN SECURITY
Is SureForms safe?
AI form generator and WordPress form builder for contact and Stripe payment forms, with surveys and quizzes in SureForms Business.
What this plugin does
- Slug:
sureforms - Author: Brainstorm Force
- 500000+ active installs
- 98/100 rating (92 reviews on wordpress.org)
- 5221640 all-time downloads
- On WordPress.org since 2024-04-01
ai formscontact formform builderformspayment form
Maintenance status
- Latest known version: 2.12.3
- Last updated: 2026-09-02 8:36am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
19 known CVEs on file for SureForms.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-85308 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.12.6 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 2.12.6 | 2.12.6 | 2026-09-03 | ⚠ update needed |
| CVE-2026-7623 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.8.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.8.2 | 2.8.2 | 2026-07-31 | ✓ fixed in latest |
| CVE-2026-18406 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.12.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 2.12.3 | 2.12.3 | 2026-07-31 | ✓ fixed in latest |
| CVE-2026-11567 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.11.1 | Improper Access Control | Unknown | < 2.11.1 | 2.11.1 | 2026-06-23 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.2.2 | — | Unknown | < 2.2.2 | 2.2.2 | 2026-02-15 | ✓ fixed in latest |
| CVE-2026-15288 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.2.2 | Improper Input Validation | High 7.5 | < 2.2.2 | 2.2.2 | 2026-02-13 | ✓ fixed in latest |
| CVE-2025-14855 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 2.2.1 | 2.2.1 | 2025-12-20 | ✓ fixed in latest |
| CVE-2025-12535 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.13.2 | Cross-Site Request Forgery (CSRF) | Medium 5.3 | < 1.13.2 | 1.13.2 | 2025-11-18 | ✓ fixed in latest |
+ 22 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-12536 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.13.2 | Exposure of Private Personal Information to an Unauthorized Actor | Medium 5.3 | < 1.13.2 | 1.13.2 | 2025-11-12 | ✓ fixed in latest |
| CVE-2025-10732 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.12.2 | Missing Authorization | Medium 4.3 | < 1.12.2 | 1.12.2 | 2025-10-13 | ✓ fixed in latest |
| CVE-2024-12713 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.2.3 | Missing Authorization | Medium 5.3 | < 1.2.3 | 1.2.3 | 2025-01-07 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.4.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Low 3.5 | < 1.4.4 | 1.4.4 | 0000-00-00 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.4.4 | — | Medium 4.9 | < 1.4.4 | 1.4.4 | 0000-00-00 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.7.4 | External Control of File Name or Path | High 8.1 | < 1.7.4 | 1.7.4 | 0000-00-00 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.7.4 | Deserialization of Untrusted Data | High 7.5 | < 1.7.4 | 1.7.4 | 0000-00-00 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.7.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.8 | < 1.7.2 | 1.7.2 | 0000-00-00 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.12.1 | Missing Authorization | Medium 4.3 | < 1.12.1 | 1.12.1 | 0000-00-00 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 2.6.0 | — | Unknown | < 2.6.0 | 2.6.0 | 0000-00-00 | ✓ fixed in latest |
| — | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz [sureforms] < 1.9.1 | — | Medium 6.1 | < 1.9.1 | 1.9.1 | 0000-00-00 | ✓ fixed in latest |
| CVE-2025-3471 | SureForms < 1.4.4 - Contributor+ Settings Update | — | Unknown | < 1.4.4 | 1.4.4 | — | ✓ fixed in latest |
| CVE-2025-3513 | SureForms < 1.4.4 - Admin+ Stored XSS | — | Unknown | < 1.4.4 | 1.4.4 | — | ✓ fixed in latest |
| CVE-2025-3514 | SureForms < 1.4.4 - Admin+ Stored XSS | — | Unknown | < 1.4.4 | 1.4.4 | — | ✓ fixed in latest |
| CVE-2025-5921 | SureForms < 1.7.2 - Reflected XSS | — | Unknown | < 1.7.2 | 1.7.2 | — | ✓ fixed in latest |
| CVE-2025-6742 | SureForms < 1.7.4 - Unauthenticated PHP Object Injection | — | Unknown | < 1.6.5 | 1.6.5 | — | ✓ fixed in latest |
| CVE-2025-6691 | SureForms < 1.7.4 - Unauthenticated Arbitrary File Deletion | — | Unknown | < 1.6.5 | 1.6.5 | — | ✓ fixed in latest |
| CVE-2025-8282 | SureForms < 1.9.1 - Admin+ Stored XSS | — | Unknown | < 1.9.1 | 1.9.1 | — | ✓ fixed in latest |
| CVE-2025-10489 | SureForms – Drag and Drop Form Builder for WordPress < 1.12.1 - Missing Authorization to Authenticated (Contributor+) Form Creation | — | Unknown | < 1.12.1 | 1.12.1 | — | ✓ fixed in latest |
| CVE-2026-4987 | SureForms < 2.6.0 - Unauthenticated Payment Amount Validation Bypass via 'form_id' | — | Unknown | < 2.6.0 | 2.6.0 | — | ✓ fixed in latest |
| — | SureForms < 2.2.2 - Unauthenticated Stripe Payment Amount Manipulation | — | Unknown | < 2.2.2 | 2.2.2 | — | ✓ fixed in latest |
| — | SureForms < 2.2.2 - Missing Authorization | — | Unknown | < 2.2.2 | 2.2.2 | — | ✓ fixed in latest |
How to fix it
Keep SureForms updated — 2.12.3 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Contact Form 7 — 10000000+ active installs — 80/100 (2179) — max PHP 8.4
- Akismet Anti-spam: Spam Protection — 5000000+ active installs — 94/100 (1186) — max PHP 8.4
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs — 96/100 (14372)
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 700000+ active installs — 96/100 (795)
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ active installs — 96/100 (2123)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.