CVE-2025-12536Medium· 5.3▾ TwilightPoC availableThe SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' paramet…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
Nuclei ×1 (last check)
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-37173High· 7.5AVideo Platform 8.1 - Information Disclosure (User Enumeration)
CVE-2026-39372Medium· 4.9InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
CVE-2026-53497Medium· 5.3CrossWatch (CW) is a synchronization engine
CVE-2026-50657Medium· 4.7Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
CVE-2025-65857High· 7.5An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06
CVE-2025-36131Medium· 4.6IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party…