The vulnerability is a stored cross‑site scripting flaw that arises from insufficient sanitization of form field parameters in the SureForms plugin. Unauthenticated attackers can inject arbitrary JavaScript into a form submission that is subsequently rendered in a WordPress page, causing the script to execute in the browsers of any user who visits that page. This permits malicious actors to perform actions such as cookie theft, session hijacking, defacement, and other client‑side attacks without needing any privileged credentials.

All versions of the SureForms plugin for WordPress up to 2.2.0 are affected. The plugin, developed by brainstormforce and marketed as SureForms – Contact Form, Payment Form & Other Custom Form Builder, provides a wide range of form‑handling features, each of which is susceptible to the stored XSS flaw when user input is not correctly filtered.

The CVSS score of 7.2 indicates a medium‑to‑high risk level, while an EPSS score of less than 1% suggests a low likelihood of real‑world exploitation at the time of this assessment. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is via the publicly accessible form submission endpoint, requiring only that an attacker crafts a request containing malicious payloads; no authentication is required. Once a victim loads a page containing the stored script, the injected code runs with the victim’s privileges.