CVE-2026-18406: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in brainstormforce SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

CVE-2026-18406 is a stored cross-site scripting (XSS) vulnerability in the SureForms WordPress plugin (versions up to 2.12.2). The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of text field inputs. This allows unauthenticated attackers to inject entity-encoded payloads that execute arbitrary scripts in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with a scope change.

An unauthenticated attacker can inject persistent malicious scripts into pages generated by the SureForms plugin. These scripts execute in the browsers of users who visit the infected pages, potentially leading to data theft, session hijacking, or other malicious actions affecting confidentiality and integrity. Availability is not impacted. The vulnerability affects all users who access the compromised content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider restricting access to the affected plugin or disabling it if possible to prevent exploitation.