CVE-2025-15705: Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS

Q: Who can exploit this issue?

A user must have access to the plugin's form editor. They can place arbitrary script in a form name, which runs when another user views the affected form.

Q: Are WordPress multisite installations especially affected?

Yes. On multisite installations, administrators that lack the unfiltered_html capability can use the issue to cross a privilege boundary.

Q: What version resolves the issue?

Upgrade Contact Form by Supsystic to version 1.8.0 or later. Versions before 1.8.0 are affected.

Published Oct 25, 2026

Updated

The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfilteredhtml capability, this crosses a privilege boundary.

Affected Software

1 affected component

Supsystic Contact Form by Supsystic<1.8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Contact Form by Supsystic to a version that resolves this vulnerability.
Fixed in 1.8.0

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user must have access to the plugin's form editor. They can place arbitrary script in a form name, which runs when another user views the affected form.

Are WordPress multisite installations especially affected?

Yes. On multisite installations, administrators that lack the unfiltered_html capability can use the issue to cross a privilege boundary.

What version resolves the issue?

Upgrade Contact Form by Supsystic to version 1.8.0 or later. Versions before 1.8.0 are affected.

CVE-2025-15705: Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are WordPress multisite installations especially affected?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are WordPress multisite installations especially affected?

What version resolves the issue?