Stored Cross-Site Scripting Vulnerability in Contact Form 7 with ChatWork Plugin for WordPress

CVE-2025-13975

What is CVE-2025-13975?

The Contact Form 7 with ChatWork plugin for WordPress exhibits a vulnerability that allows authenticated attackers, possessing administrator-level access, to inject arbitrary web scripts through the 'api_token' and 'roomid' settings. This issue arises from inadequate input sanitization and output escaping, particularly in environments using multi-site installations or where the ability to filter HTML is disabled. When successfully exploited, any user accessing the settings page can have their session compromised, leading to unintended actions or data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References