Stored Cross-Site Scripting in Contact Form Plugin by WordPress
CVE-2025-5730
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 June 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-5730?
The Contact Form Plugin for WordPress prior to version 1.1.29 suffers from a vulnerability where it fails to adequately sanitize and escape user-defined settings. This oversight allows high-privilege users, such as contributors, to exploit the flaw by performing stored Cross-Site Scripting (XSS) attacks, potentially compromising the integrity and security of the web application.
Affected Version(s)
Contact Form Plugin 0 < 1.1.29
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.