Jessie Irelan

**Name of the Vulnerable Software and Affected Versions** SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress versions through 1.12.0 **Description** The SureForms plugin for WordPress is susceptible to unauthorized form creation due to a missing capability check within the `register post types()` function. This allows authenticated attackers with Contributor-level access or higher to create forms, even when the user interface restricts this action. **Recommendations** Update to a version beyond 1.12.0.

Name of the Vulnerable Software and Affected Versions: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress versions through 3.14.3 Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is susceptible to Stored Cross-Site Scripting via the `gdpr communication preferences[]` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into pages, which will execute when a user accesses the injected page. This is only exploitable when the GDPR Communication Preferences module is enabled and at least one GDPR Communication Preferences field has been added to the edit profile form. Recommendations: Update to a version beyond 3.14.3. Disable the GDPR Communication Preferences module. Remove any GDPR Communication Preferences fields from the edit profile form.