CVE-2025-8280

MediumCVSS 5.8/10Last modified Sep 30, 2026

Description

The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Contact Form 7 reCAPTCHA	<= 1.2.0

References

https://wpscan.com/vulnerability/f8370026-6293-4814-961f-c254ee8e844d/Exploit, Third Party Advisory

Timeline

Published: Sep 12, 2025
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-82817.1The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl CVE-2025-82823.5The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow CVE-2025-82833.7A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being re CVE-2025-82849.8By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow CVE-2025-82855.3Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel su CVE-2025-82869.3The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configur CVE-2025-82897.5The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 vi CVE-2025-82906.4The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and inc CVE-2025-82914.3The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used CVE-2025-82928.8Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via CVE-2025-82936.4The Intl DateTime Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to,CVE-2025-82946.4The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and i