CVE-2025-5730
BaseFortify
Publication date: 2025-06-30
Last updated on: 2025-07-01
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ghozylab | contact_form | to 1.1.29 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5730 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Easy Contact Form Lite versions before 1.1.29. The plugin does not properly sanitize and escape certain settings, allowing users with Contributor-level privileges or higher to inject malicious scripts. For example, a Contributor can insert a malicious script into the Placeholder input of a form field, which then executes every time the form is loaded in the WordPress admin interface. [1]
How can this vulnerability impact me? :
This vulnerability can allow a user with Contributor-level privileges to execute malicious scripts within the WordPress admin interface. This can lead to unauthorized actions such as stealing session cookies, defacing the admin panel, or performing actions on behalf of other users with higher privileges, potentially compromising the website's security and integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the installed version of the Easy Contact Form Lite WordPress plugin is prior to 1.1.29. Additionally, you can test for the vulnerability by attempting to insert a known XSS payload such as '</div><img src=x onerror=alert(1)>' into the Placeholder input of any form field in the plugin's Easy Form tab within the WordPress admin panel. If the payload executes when the form is loaded, the system is vulnerable. There are no specific network commands provided for detection. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Easy Contact Form Lite WordPress plugin to version 1.1.29 or later, where the issue has been fixed. Additionally, restrict Contributor-level users from accessing the form settings until the update is applied to prevent exploitation. [1]