PatchTheCVEsureforms vulnerabilities and fixes
Recent CVEs affecting sureforms, with upgrade or downgrade steps. 7 tracked.
sureforms has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-08-01. Highest priority: CVE-2025-6691 (score 44/100).
- CVE-2025-6742 HIGH 7.5 UPGRADE The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Inje
- CVE-2025-6691 HIGH 8.1 UPGRADE The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file
- CVE-2025-5921 MEDIUM 5.8 UPGRADE The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it bac
- CVE-2025-3514 LOW 3.5 UPGRADE The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which cou
- CVE-2025-3513 LOW 3.5 UPGRADE The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which cou
- CVE-2025-3471 MEDIUM 4.9 UPGRADE The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settin
- CVE-2024-12713 MEDIUM 5.3 UPGRADE The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exp
FAQ
How do I fix sureforms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sureforms being exploited right now?
None of the tracked sureforms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sureforms CVE should I patch first?
CVE-2025-6691 currently ranks highest (44/100): The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file .