CVE-2025-15705— Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS

Quick assessment

Affected

Unknown Contact Form by Supsystic

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Supsystic 开发的 Contact Form WordPress 插件在 1.8.0 版本之前，未对表单名称进行清理和转义处理，导致拥有表单编辑器访问权限的用户可以注入任意 Web 脚本；当其他用户查看该表单时，这些脚本将被执行。在允许多站点的安装环境中，如果管理员未拥有权限，此漏洞将突破权限边界。

AI Predicted 6.1 Difficulty: Moderate EPSS 0.15% · P4 Updated Oct 25, 2026

Possible ATT&CK Techniques 3 AI

T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client Execution T1055 · Process Injection

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS

Source: CVE Program / CVE List V5

Vulnerability Description

The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Contact Form by Supsystic	0 ~ 1.8.0	-

II. Public POCs for CVE-2025-15705

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-15705

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2025-15705

Same Patch Batch · Unknown · 2026-10-25 · 15 CVEs total

CVE-2026-114743		InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin
CVE-2026-115183		Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
CVE-2026-115214		Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol
CVE-2026-115251		Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click
CVE-2026-114742		WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
CVE-2026-114740		WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizar
CVE-2026-114741		WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
CVE-2026-111979		GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
CVE-2026-111980		GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability
CVE-2026-111981		GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_ad
CVE-2026-111978		GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
CVE-2026-111976		GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Rou
CVE-2026-110285		WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Web
CVE-2026-94295		Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger

IV. Related Vulnerabilities

Same product: Contact Form by Supsystic

Same vendor: Unknown