CVE-2025-5730

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-573056.5VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.CVE-2025-57315.5A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and inc CVE-2025-573108.8A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allo CVE-2025-573177.5apidoc-core is the core parser library to generate apidoc result following the apidoc-spec. A Prototype Pollution vulnerability in the prePr CVE-2025-573187.5A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.pro CVE-2025-573197.5fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of f CVE-2025-57328.8A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unkno CVE-2025-573206.5json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData fu CVE-2025-573219.8A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inj CVE-2025-573237.5mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp CVE-2025-573246.5parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeStat CVE-2025-573257.5rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error tracki