The SureForms plugin is vulnerable to a stored XSS flaw that can be triggered by contributors or higher. The flaw arises from the insufficient sanitization of the 'headingWrapper' block attribute, allowing an attacker to inject arbitrary JavaScript into form page blocks. When other users view the affected page, the malicious code executes in their browsers and can steal session cookies, deface content, or exfiltrate data—an impact consistent with CWE‑79.

WordPress sites that have installed the SureForms Contact/Form Builder plugin with any version up to and including 2.8.1. No other vendors or products are affected, and the issue is confined to the plugin’s block implementation for advanced‑heading blocks.

The CVSS base score of 6.4 indicates a moderate severity. The EPSS score of less than 1% shows that the likelihood of exploitation observed in monitoring is very low, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user with contributor or higher privileges; the attacker can inject a payload into the headingWrapper attribute, which is then stored and rendered unescaped for all users who view the form page.