Stored Cross-Site Scripting Vulnerability in HTML Forms Plugin for WordPress

CVE-2025-12125

What is CVE-2025-12125?

The HTML Forms – Simple WordPress Forms Plugin is subject to a Stored Cross-Site Scripting vulnerability due to inadequate sanitization of inputs and escaping of outputs in its admin settings. This issue affects installations with administrator-level access, allowing authenticated attackers to inject malicious web scripts into pages. The vulnerability particularly impacts multi-site configurations or instances where the unfiltered_html feature has been disabled, posing significant risks to users upon accessing compromised pages.

References