SureForms

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. SureForms < 1.4.4 - Contributor+ Settings UpdateCVE-2025-3471Brainstormforce · CVSS 4.9 · 0.4% likely

   CWE-863

2. WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-85308Brainstorm Force · CVSS 5.3 · 0.3% likely

   CWE-639

3. SureForms < 1.4.4 - Admin+ Stored XSSCVE-2025-3513Brainstormforce · CVSS 3.5 · 0.3% likely

   CWE-79

4. WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerabilityCVE-2026-116402Brainstorm Force · CVSS 5.3 · 0.3% likely

   CWE-80

5. WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerabilityCVE-2026-125763Brainstorm Force · CVSS 5.3 · 0.3% likely

   CWE-862

6. WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerabilityCVE-2026-120842Brainstorm Force · CVSS 5.3 · 0.3% likely

   CWE-862

7. SureForms < 1.4.4 - Admin+ Stored XSSCVE-2025-3514Brainstormforce · CVSS 3.5 · 0.3% likely

   CWE-79

8. SureForms < 1.7.2 - Reflected XSSCVE-2025-5921Brainstormforce · CVSS 5.8 · 0.2% likely

   CWE-79

9. WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerabilityCVE-2026-116387Brainstorm Force · CVSS 5.3 · 0.2% likely

   CWE-862

10. WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-108495Brainstorm Force · CVSS 6.5 · 0.1% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.