Stored XSS Vulnerability in CodePeople Contact Form Email Product
CVE-2025-24727

4.8MEDIUM

Key Information:

Vendor

WordPress
Status
Contact Form Email
Vendor
CVE Published:
24 January 2025

What is CVE-2025-24727?

A Cross-site Scripting (XSS) vulnerability has been identified in the CodePeople Contact Form Email plugin. This security flaw allows attackers to inject malicious scripts that can be stored and executed on the web application, compromising user data and session information. The issue affects all versions of the Contact Form Email plugin from n/a up to 1.3.52, making it crucial for users to upgrade to a patched version to mitigate the risks associated with this vulnerability.

Affected Version(s)

Contact Form Email <= 1.3.52

References

https://patchstack.com/database/wordpress/plugin/contact-...
vdb-entry

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Roby Firnando Yusuf (Patchstack Alliance)
.