[ CVE-2025-15705 · Published 25 Oct 2026 ]
Vulnerability in Unknown Contact Form by Supsystic
Not scored yet
No fix listed yet
[ Description ]Official description
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.