WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

AI form generator and WordPress form builder for contact and Stripe payment forms, with surveys and quizzes in SureForms Business.

19Reported vulnerabilities
8.1Highest CVSS score
2.12.3Latest version
500,000+Active installs

What to do now

Update SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz to 2.12.3 or later. 19 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 6, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2025-3471 Medium 4.9 0.3% Before 1.4.4 1.4.4 April 30, 2025
CVE-2025-6691 High 8.1 1.0% 0.0.2 up to (but not including) 0.0.14
1.0.0 up to (but not including) 1.0.7
1.1.0 up to (but not including) 1.1.2
1.2.0 up to (but not including) 1.2.5
1.3.0 up to (but not including) 1.3.2
1.4.0 up to (but not including) 1.4.5
1.6.0 up to (but not including) 1.6.5
1.7.0 up to (but not including) 1.7.4
1.5.0 to 1.5.0 (inclusive)		 0.0.14 July 9, 2025
CVE-2026-4987 High 7.5 1.0% 0 to 2.5.2 (inclusive) 2.6.0 March 28, 2026
CVE-2026-15288 High 7.5 0.5% 0 to 2.2.1 (inclusive) 2.2.2 July 10, 2026
CVE-2025-6742 High 7.5 0.5% 0.0.2 up to (but not including) 0.0.14
1.0.0 up to (but not including) 1.0.7
1.1.0 up to (but not including) 1.1.2
1.2.0 up to (but not including) 1.2.5
1.3.0 up to (but not including) 1.3.2
1.4.0 up to (but not including) 1.4.5
1.6.0 up to (but not including) 1.6.5
1.7.0 up to (but not including) 1.7.4
1.5.0 to 1.5.0 (inclusive)		 0.0.14 July 9, 2025
CVE-2025-3514 Low 3.5 0.3% Before 1.4.4 1.4.4 May 2, 2025
CVE-2025-3513 Low 3.5 0.3% Before 1.4.4 1.4.4 May 2, 2025
CVE-2026-18406 High 7.2 0.3% 0 to 2.12.2 (inclusive) 2.12.3 September 5, 2026
CVE-2025-14855 High 7.2 0.4% 0 to 2.2.0 (inclusive) 2.2.1 December 21, 2025
CVE-2026-7623 Medium 6.4 0.2% 0 to 2.8.1 (inclusive) 2.8.2 August 1, 2026
CVE-2025-5921 Medium 5.8 0.2% Before 1.7.2 1.7.2 August 1, 2025
CVE-2025-12536 Medium 5.3 0.8% 0 to 1.13.1 (inclusive) 1.13.2 November 13, 2025
CVE-2026-11567 Medium 5.3 0.3% 2.11.0 and earlier 2.11.1 June 23, 2026
WF-061a14bf-d067-4924-b2f4-2f5986204532 Medium 5.3 — 2.2.1 and earlier 2.2.2 February 15, 2026
CVE-2025-12535 Medium 5.3 0.2% 0 to 1.13.1 (inclusive) 1.13.2 November 19, 2025
CVE-2024-12713 Medium 5.3 0.3% Before 1.2.3 1.2.3 January 8, 2025
CVE-2025-10732 Medium 4.3 0.2% 0 to 1.12.1 (inclusive) 1.12.2 October 14, 2025
CVE-2025-10489 Medium 4.3 0.2% 0 to 1.12.0 (inclusive) 1.12.1 September 20, 2025
CVE-2025-8282 Medium 4.4 0.2% 1.9.0 and earlier 1.9.1 September 2, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.