{"id":"CVE-2025-15705","kind":"vulnerability","aliases":["CVE-2025-15705"],"related":[],"title":"Contact Form by Supsystic WordPress plugin: stored script injection via form name","description":"The Contact Form by Supsystic  WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.","summary":"The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise or escape a form name. A user with access to the form editor can store a script that runs in the browser of anyone who views the form, and on multisite installs this can cross from a lower role into administrator-level context.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","wordpress","wordpress-plugin"],"not_affected_if":["only-trusted-form-editors","plugin-not-installed","version-1.8.0-or-later"],"how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugins list; versions before `1.8.0` are affected.\n- Review the plugin's form editor for form names containing script or HTML tags, if you suspect injection.","fix":"- Update the Contact Form by Supsystic plugin to `1.8.0` or later.","status":"open","published_at":"2026-10-25T06:16:29+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:44+00:00","updated_at":"2026-10-25T06:37:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T06:37:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Contact Form by Supsystic plugin to `1.8.0` or later.","reach":"network","title":"Contact Form by Supsystic WordPress plugin: stored script injection via form name","impact":"medium","summary":"The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise or escape a form name. A user with access to the form editor can store a script that runs in the browser of anyone who views the form, and on multisite installs this can cross from a lower role into administrator-level context.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","multisite"],"confidence":0.7,"needs_auth":"yes","worst_case":"Injected script runs in other users' browsers, possibly escalating privileges on multisite.","analyst_note":"","how_to_check":"- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugins list; versions before `1.8.0` are affected.\n- Review the plugin's form editor for form names containing script or HTML tags, if you suspect injection.","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.8.0-or-later","only-trusted-form-editors"],"who_is_affected":"Sites running the Contact Form by Supsystic plugin below `1.8.0`, especially WordPress multisite installs where administrators lack the unfiltered_html capability. Single-site installs where only trusted administrators can edit forms carry less risk. Sites that do not use this plugin are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3329,"output_tokens":565,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15705':15A,18A '-2025':14A,17A '1.8.0':33B,89C 'access':45B,101C 'administr':78B,123C 'administrator-level':77B 'allow':98C 'anoth':114C 'anyon':60B 'arbitrari':108C 'boundari':135C 'browser':58B 'capabl':130C 'contact':1A,26B,82C 'context':80B 'cross':71B,132C 'cve':13A,16A 'editor':49B,105C 'escap':38B,94C 'execut':112C 'form':2A,11A,27B,40B,48B,64B,83C,96C,104C,118C 'hold':126C 'html':129C 'inject':9A,107C 'instal':68B,121C 'level':79B 'lower':74B 'multisit':19B,67B,120C 'name':12A,41B,97C 'packag':20B 'plugin':6A,24B,31B,87C 'privileg':134C 'role':75B 'run':55B 'sanitis':36B,92C 'script':8A,53B,110C 'store':7A,51B 'supsyst':4A,29B,85C 'unfilt':128C 'user':43B,99C,115C 'via':10A 'view':62B,116C 'web':109C 'wordpress':5A,21B,23B,30B,86C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Contact Form by Supsystic plugin below `1.8.0`, especially WordPress multisite installs where administrators lack the unfiltered_html capability. Single-site installs where only trusted administrators can edit forms carry less risk. Sites that do not use this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-15705","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15705","severity":null,"published_at":"2026-10-25T06:16:29+00:00","modified_at":"2026-10-25T06:16:29+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}