SureForms WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the SureForms WordPress plugin, affecting versions prior to 1.7.2. The issue arises because the plugin fails to properly sanitize and escape a parameter before displaying it on the page. This vulnerability can be exploited by both authenticated and unauthenticated users.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a new blank form and add a text block. In the 'Default Value' field, enter a payload that includes a GET parameter. Then, access the form with the crafted URL that includes the injected script. Hover over the text field to trigger the cross-site scripting payload.

Remediation

Users are advised to update the SureForms WordPress plugin to version 1.7.2 or later.