CVE-2025-5730: Easy Contact Form Lite < 1.1.29 - Contributor+ Stored XSS
Published Jun 30, 2025
·Updated
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
Affected Software
3 affected components
Easy Contact Form Lite<1.1.29
WordPress Contact Form Plugin<1.1.29
GhozyLab Contact Form Wordpress<1.1.29
Event History
Jun 30, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-5730?
CVE-2025-5730 has been classified as a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
2
How do I fix CVE-2025-5730?
To fix CVE-2025-5730, update the Contact Form Plugin to version 1.1.29 or later.
3
Who is affected by CVE-2025-5730?
CVE-2025-5730 affects users of the Contact Form Plugin for WordPress before version 1.1.29.
4
What type of vulnerability is CVE-2025-5730?
CVE-2025-5730 is a Stored Cross-Site Scripting (XSS) vulnerability.
5
What can attackers do with CVE-2025-5730?
Attackers with high privileges can exploit CVE-2025-5730 to inject malicious scripts that could be executed by users of the affected plugin.