The vulnerability is an instance of Stored Cross‑Site Scripting (XSS) caused by improper neutralisation of input during web page generation in the Brainstorm Force SureForms plugin. This flaw allows attackers to inject malicious scripts that are stored and subsequently rendered in user‑viewable pages, potentially leading to session hijacking, defacement, or the execution of arbitrary code within the context of the website's domain. The weakness is identified as CWE‑79.

Affected systems include the WordPress SureForms plugin released by Brainstorm Force, specifically versions up to and including 2.12.7. Any WordPress installation that uses this plugin and has not upgraded beyond 2.12.7 may be vulnerable to the stored XSS condition.

The CVSS score of 6.5 indicates moderate severity, and the current EPSS score is unavailable while the vulnerability is not present in the CISA KEV catalog. Attackers can exploit this flaw via web through any form or input field that is processed by SureForms; no special privileges or credentials are required beyond submitting content that is stored. The lack of an EPSS figure suggests that public exploitation data is limited, but the moderate CVSS still warrants prompt remediation.