What’s Vulnerable › Vulnerabilities
CVE-2025-15705: Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
- Severity: low (CVSS 3.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-25 · updated 2026-10-26
- Weakness: CWE-79
Description
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
Affected products
- Contact Form by Supsystic: before 1.8.0 — fixed in 1.8.0
How to fix
Upgrade to a fixed version: Contact Form by Supsystic 1.8.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-15705 or the next vulnerability affects your stack