CVE-2025-15705 in Contact Form by Supsystic Plugin
Summary
by MITRE • 10/25/2026
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in Contact Form by Supsystic versions prior to 1.8.0 represents a critical security flaw within WordPress plugin architecture, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. This issue arises from the failure of the application to properly sanitize and escape user-supplied input when handling form names within the editor interface. In a typical web application lifecycle, data entered by users into forms is often stored in a database and later rendered back to other users for viewing. When this specific field lacks adequate encoding or validation mechanisms, it allows an attacker to inject malicious client-side scripts directly into the page content served to victims.
The operational impact of this vulnerability is significant because it enables Stored Cross-Site Scripting attacks. An adversary with access to the form editor can embed JavaScript code within the form name metadata. When another user subsequently views or interacts with a webpage displaying this compromised contact form, the browser parses and executes the injected script in the context of the victim's session. This execution environment grants the malicious script full access to cookies, local storage, and other sensitive data associated with the current site authentication state. Consequently, attackers can perform actions such as stealing administrative credentials, hijacking user sessions, defacing websites, or redirecting users to phishing sites designed to harvest further information.
A particularly concerning aspect of this vulnerability is its behavior on WordPress multisite installations where privilege boundaries are strictly enforced. In these environments, certain roles may lack the unfiltered_html capability, which normally restricts the insertion of raw HTML and script tags through standard editors. However, because the flaw exists in how the form name field processes data rather than relying solely on the visual editor's filtering rules, it effectively bypasses these intended restrictions. This allows users who should be restricted from executing arbitrary code to cross privilege boundaries, achieving a level of access that exceeds their assigned role permissions and compromising the integrity of the multi-tenant environment.
From an industry standard perspective, this vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically through browser-based scripting languages like JavaScript. The attack vector leverages the trust relationship between a user's browser and the web application to execute unauthorized commands. To mitigate this risk, immediate action is required by updating the Contact Form plugin to version 1.8.0 or later where these sanitization issues have been addressed. Administrators should also implement strict Content Security Policy headers to limit script execution sources and regularly audit plugins for proper input validation practices. Additionally, enforcing role-based access control with minimal privileges ensures that even if a vulnerability exists, the potential blast radius is contained by limiting who can modify form structures in the first place.