CVE-2026-7623 is a stored cross-site scripting vulnerability in the SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz WordPress plugin. The flaw exists in the 'headingWrapper' parameter, which lacks proper input sanitization and output escaping, allowing authenticated users with contributor-level privileges or higher to inject arbitrary scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 2.8.1. There is no vendor advisory or patch information available at this time.

The vulnerability allows authenticated users with contributor-level access or higher to perform stored cross-site scripting attacks. This can lead to the execution of arbitrary scripts in the context of other users viewing the affected pages, potentially compromising user sessions or enabling other malicious actions. The CVSS v3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider additional input validation or web application firewall rules to detect and block malicious payloads targeting the 'headingWrapper' parameter.