Stored Cross-Site Scripting Vulnerability in FormCraft Plugin by WordPress

CVE-2025-0817

What is CVE-2025-0817?

The FormCraft plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping when handling SVG file uploads. This issue allows unauthenticated attackers to inject arbitrary web scripts into pages, leading to potential execution whenever users access the affected SVG files. Website administrators utilizing FormCraft should address this vulnerability immediately to prevent exploitation.

References