CVE-2025-8282

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
3.5LOW
EPSS
0.0%
top 94.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Unknown Sureforms
Timeline
PublishedSep 23

Description

The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:NExploitability: 0.9 | Impact: 2.5

Affected Packages1 packages

▶CVEListV5unknown/sureforms< 1.9.1

🔴Vulnerability Details

2
GHSA
GHSA-m7f8-rpm5-xmqj: The SureForms WordPress plugin before 1↗2025-09-23
▶
CVEList
SureForms < 1.9.1 - Admin+ Stored XSS↗2025-09-23
▶
CVE-2025-8282 (LOW CVSS 3.5) | The SureForms WordPress plugin befo | cvebase.io