CVE-2025-14855

HIGH

SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-14855 has a selected CVSS score of 7.2 (high); EIP currently links 1 repository PoC.

Description

The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 22, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SureForms – Contact Form, Payment Form & Other Custom Form Builder

Browse brainstormforce / SureForms – Contact Form, Payment Form & Other Custom Form Builder

Default status: unaffected

CVE ListThrough 2.2.0affected

Proofs of concept

1

Repository PoCs

GitHubch4r0nn/CVE-2025-14855-POCRepository PoCby ch4r0nn2Writeup1 file

5.0 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing a stored XSS vulnerability (CVE-2025-14855) in the SureForms WordPress plugin. It provides root cause analysis of client-side JavaScript code that decodes HTML entities and renders them via dangerouslySetInnerHTML, and includes a manual proof-of-concept payload. No executable exploit or scanner code is provided.

Backdoor review

No backdoor observed in reviewed code

The artifact is a documentation-only README.md describing a Stored XSS vulnerability (CVE-2025-14855) in the SureForms WordPress plugin. It contains no executable code, no hidden payloads, and no instructions for the reader to perform any action beyond submitting a benign XSS proof-of-concept string to a target form. The described exploit behavior targets the stated vulnerability and does not exhibit backdoor or trojan characteristics.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesMarkdown
Target softwareSureForms WordPress Plugin
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a detailed technical analysis of a vulnerability, including root cause analysis and a manual proof-of-concept description. It does not contain any executable code that exploits or scans for the vulnerability; it only describes the steps and payloads for a human to follow. This matches the definition of a writeup.

README.md:1-114

Requirements

  • Target site must have a vulnerable version of SureForms plugin (<= 2.2.0) installed.README.md:1-6
  • Attacker must be able to submit a form on the frontend (unauthenticated).README.md:83-84
  • An administrator must view the submitted entry in the SureForms admin interface.README.md:86-87

Observed behavior

  • Describes how an attacker can submit HTML entities in a form field to bypass server-side sanitization.README.md:83-84
  • Explains that the client-side JavaScript function Xv decodes HTML entities back to raw HTML.README.md:35-54
  • Explains that the decoded HTML is rendered using dangerouslySetInnerHTML without sanitization, leading to script execution.README.md:63-78
  • Provides a manual proof-of-concept payload (<img src=x onerror=alert('XSS_SUREFORMS')>) and steps to trigger it.README.md:92-109
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Poc Payload
&lt;img src=x onerror=alert('XSS_SUREFORMS')&gt;The only payload present is a standard XSS proof-of-concept using HTML entities to bypass sanitization, targeting the described vulnerability.README.md:99
Review boundaries

What the analysis did not establish

  • The evidence consists of a single README.md file; no source code, exploit scripts, or scanner code are included.
  • The analysis of the vulnerable JavaScript functions (Xv, Jv) is reconstructed from a minified file and not directly verifiable from the provided evidence.
  • The artifact describes a manual PoC process; it does not provide an automated script to perform the attack or check for the vulnerability.
  • Only the README.md file was provided for review; no other files from the repository were inspected.
  • Binary files were flagged but not analyzed; none were identified in the packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4