◆ CVE Hub

CVE-2025-15705

Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS

Published
2026-10-25
Last modified
2026-10-25
CNA
WPScan
NVD status
Received
CWE
CWE-79
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed

Description

NVD

The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.

Affected products and packages

CNA (CVE.org)

VendorProductVersions
UnknownContact Form by Supsystic
affected: 0 … < 1.8.0
default: unaffected

Linux distribution status

Red Hat ↗

Not tracked by this distribution.

Debian ↗

No record

Ubuntu ↗

Not tracked by this distribution.

References (1)