CVE-2025-5921

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	SureForms	< 1.7.2

References

https://wpscan.com/vulnerability/052fb6cf-274e-468b-a7e0-0e7a1751ec75/Third Party Advisory

Timeline

Published: Aug 1, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-592107.4Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability CVE-2025-592115.5Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose infor CVE-2025-592138.8Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthoriz CVE-2025-592146.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over CVE-2025-592157.0Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2025-592167.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an author CVE-2025-592189.6Azure Entra ID Elevation of Privilege Vulnerability CVE-2025-59224.8Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code. CVE-2025-592207.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorize CVE-2025-592217.0Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-592227.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-592237.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.