CVE-2025-32199: WordPress Contact Form Builder by vcita plugin <= 4.10.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyale-vc Contact Form Builder by vcita contact-form-with-a-meeting-scheduler-by-vcita allows DOM-Based XSS.This issue affects Contact Form Builder by vcita: from n/a through <= 4.10.2.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyale-vc Contact Form Builder by vcita. This issue affects Contact Form Builder by vcita: from n/a through 4.10.2.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32199?
CVE-2025-32199 has a moderate severity level due to the potential for Cross-site Scripting (XSS) attacks.
How do I fix CVE-2025-32199?
You can fix CVE-2025-32199 by updating the Contact Form Builder by vcita to version 4.10.3 or later.
What software is affected by CVE-2025-32199?
CVE-2025-32199 affects the Contact Form Builder by vcita from versions n/a through 4.10.2.
What type of vulnerability is CVE-2025-32199?
CVE-2025-32199 is classified as a Cross-site Scripting (XSS) vulnerability.
Can CVE-2025-32199 impact WordPress sites?
Yes, CVE-2025-32199 can impact WordPress sites using the Contact Form Builder by vcita plugin.