SureForms <= 2.8.1 Authenticated Stored XSS via 'headingWrapper' (CVE-2026-7623)

漏洞概述 漏洞名称: SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute CVE ID: CVE-2026-7623 CVSS 评分: 6.4 (Medium) 发布日期: July 31, 2026 最后更新日期: August 1, 2026 研究人员: Dmitrii Ignatyev - CleanTalk Inc 影响范围 受影响软件: SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz 软件类型: Plugin 软件 Slug: sureforms (view on wordpress.org) 是否已修复: Yes 修复版本: Update to version 2.8.2, or a newer patched version 受影响版本: <= 2.8.1 修复版本: 2.8.2 修复方案 修复建议: 更新到版本 2.8.2 或更新的已修复版本。 其他信息 描述: SureForms 插件在 WordPress 中用于创建联系表单、支付表单和其他自定义表单。该插件在版本 2.8.1 及更早版本中存在存储型跨站脚本（XSS）漏洞，攻击者可以通过注入恶意脚本来执行任意 JavaScript 代码。 参考链接: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 近期漏洞 SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass - CVE ID: CVE-2026-11567 - CVSS 评分: 5.3 - 研究人员: Yashwant Reddy Sunkara - 日期: June 23, 2026 SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via Form Id - CVE ID: CVE-2026-4987 - CVSS 评分: 7.5 - 研究人员: AlexHenry - 日期: March 27, 2026 SureForms <= 2.2.1 - Missing Authorization - CVE ID: CVE-2026-15288 - CVSS 评分: 5.3 - 研究人员: andrea bocchetti - 日期: February 13, 2026 SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation - CVE ID: CVE-2026-15288 - CVSS 评分: 7.5 - 研究人员: andrea bocchetti - 日期: February 13, 2026 SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting - CVE ID: CVE-2025-14855 - CVSS 评分: 7.2 - 研究人员: Tien Dung Nguyen - 日期: December 20, 2025 SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution - CVE ID: CVE-2025-12535 - CVSS 评分: 5.3 - 研究人员: typeSafe - 日期: November 18, 2025 SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure - CVE ID: CVE-2025-12536 - CVSS 评分: 5.3 - 研究人员: typeSafe - 日期: November 12, 2025 SureForms – Drag and Drop Form Builder for WordPress <= 1.21.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure - CVE ID: CVE-2025-10732 - CVSS 评分: 4.3 - 研究人员: Abu Hurayza (HurayzIT) - 日期: October 13, 2025 SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation - CVE ID: CVE-2025-10489 - CVSS 评分: 4.3 - 研究人员: Alex - 日期: September 19, 2025 SureForms – Drag and Drop Form Builder for WordPress <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting - CVE ID: CVE-2025-8282 - CVSS 评分: 4.4 - 研究人员: Dmitrii Ignatyev - 日期: September 2, 2025 总结 该页面主要介绍了 SureForms 插件中存在的多个安全漏洞，其中最严重的是存储型跨站脚本（XSS）漏洞，影响版本为 2.8.1 及更早版本。建议用户尽快更新到 2.8.2 或更高版本以修复此漏洞。

目標達成すべての支援者に感謝 — 100%達成しました！

SureForms <= 2.8.1 Authenticated Stored XSS via 'headingWrapper' (CVE-2026-7623)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

SureForms <= 2.8.1 Authenticated Stored XSS via 'headingWrapper' (CVE-2026-7623)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！