High
CVE-2026-18406
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 21
Reset filters
Medium
CVE-2026-85308
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-7623
SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute
Medium
CVE-2026-11567
SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass
Medium
CVE-2026-42377
SureForms Pro <= 2.8.0 - Missing Authorization
High
CVE-2026-4987
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
Medium
061a14bf-d067-4924-b2f4-2f5986204532
SureForms <= 2.2.1 - Missing Authorization
High
CVE-2026-15288
SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation
High
CVE-2025-14855
SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-12535
SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
Medium
CVE-2025-12536
SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-10732
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure
Medium
CVE-2025-10489
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation
Medium
CVE-2025-8282
SureForms – Drag and Drop Form Builder for WordPress <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-5921
SureForms <= 1.7.1 - Reflected Cross-Site Scripting
High
CVE-2025-6691
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion
High
CVE-2025-6742
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion
Medium
CVE-2025-3514
SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-3513
SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-3471
SureForms – Drag and Drop Form Builder for WordPress <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Settings Update
Medium
CVE-2024-12713
SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.