CVE-2026-18406

CVE-2026-18406 is a stored cross-site scripting vulnerability in the SureForms contact form plugin for WordPress, caused by insufficient input sanitization and output escaping of text field submissions containing entity-encoded payloads. An unauthenticated attacker can submit a crafted payload through a SureForms form's text field; the payload is stored on the site and executes as arbitrary web script whenever any user accesses an affected page. Successful exploitation allows the attacker to run JavaScript in the browsers of site visitors and administrators, potentially enabling session theft, redirects, or privileged actions. Any WordPress site running SureForms version 2.12.2 or earlier with a published form using a text field is affected. No public proof-of-concept or in-the-wild exploitation is known, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Update the SureForms plugin to the latest available release (any version newer than 2.12.2) as soon as a patched version is published. Until updated, review existing stored form entries and pages containing SureForms forms for unexpected script tags or encoded payloads, and temporarily restrict or monitor unauthenticated form submissions. No exploitation has been reported, so patching promptly should preempt any in-the-wild attacks.