Stored Cross-Site Scripting Vulnerability in Contact Form 7 with ChatWork Plugin for WordPress

CVE-2025-13975

What is CVE-2025-13975?

The Contact Form 7 with ChatWork plugin for WordPress exhibits a vulnerability that allows authenticated attackers, possessing administrator-level access, to inject arbitrary web scripts through the 'api_token' and 'roomid' settings. This issue arises from inadequate input sanitization and output escaping, particularly in environments using multi-site installations or where the ability to filter HTML is disabled. When successfully exploited, any user accessing the settings page can have their session compromised, leading to unintended actions or data exposure.

References