---
id: "CVE-2025-15705"
kind: "vulnerability"
aliases: ["CVE-2025-15705"]
title: "Contact Form by Supsystic WordPress plugin: stored script injection via form name"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multisite", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["only-trusted-form-editors", "plugin-not-installed", "version-1.8.0-or-later"]
published_at: "2026-10-25T06:16:29+00:00"
first_seen_at: "2026-10-25T06:36:35+00:00"
updated_at: "2026-10-25T06:37:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15705", "first_seen_at": "2026-10-25T06:36:35+00:00"}]
---

# Contact Form by Supsystic WordPress plugin: stored script injection via form name

The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise or escape a form name. A user with access to the form editor can store a script that runs in the browser of anyone who views the form, and on multisite installs this can cross from a lower role into administrator-level context.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Contact Form by Supsystic plugin in the WordPress admin plugins list; versions before `1.8.0` are affected.
- Review the plugin's form editor for form names containing script or HTML tags, if you suspect injection.

## Fix

- Update the Contact Form by Supsystic plugin to `1.8.0` or later.

## Timeline

- 2026-10-25T06:36:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-15705

## From the sources

The Contact Form by Supsystic  WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_