CVE-2025-15705
Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
| Vendor | unknown |
| Product | contact form by supsystic |
| Published | Oct 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown contact form by supsystic
Be the first to know when new unknown vulnerabilities affecting unknown contact form by supsystic are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Contact Form by Supsystic
0 < 1.8.0
References
Credits
Hanif Naufal Rahman WPScan