Live › vulnerability › CVE-2025-15705
Go to dashboardThe Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise or escape a form name. A user with access to the form editor can store a script that runs in the browser of anyone who views the form, and on multisite installs this can cross from a lower role into administrator-level context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the Contact Form by Supsystic plugin below , especially WordPress multisite installs where administrators lack the unfiltered_html capability. Single-site installs where only trusted administrators can edit forms carry less risk. Sites that do not use this plugin are not affected.
1.8.0No product ranges from the sources yet.
1.8.0 are affected.1.8.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
This page as .md · .json · in your agent: get_signal("CVE-2025-15705")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.