Stored Cross-Site Scripting Vulnerability in Contact Form 7 Plugin for WordPress
CVE-2025-9562

6.4MEDIUM

Key Information:

Vendor: WordPress
Status: Redirection For Contact Form 7
Vendor: CVE Published:; 18 October 2025

What is CVE-2025-9562?

The Contact Form 7 plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access to inject arbitrary web scripts through the plugin's qs_date shortcode. This is due to insufficient input sanitization and output escaping on user-supplied attributes. When a user accesses a page containing the injected scripts, the attacker's code executes, potentially compromising user data and site security.

Affected Version(s)

Redirection for Contact Form 7 * <= 3.2.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/wpcf7-redirect...

https://wordpress.org/plugins/wpcf7-redirect/

CVSS V3.1

Score:

6.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
Oct 18, 2025
Vulnerability Reserved
Aug 27, 2025

Credit

Muhammad Yudha - DJ

JSON