CVE-2025-8315

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
emarket-design	Simple Contact Form Plugin for WordPress – WP Easy Contact	<= 4.0.1

References

Timeline

Published: Aug 5, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-83166.4The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and inc CVE-2025-83176.4The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and CVE-2025-83186.4The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and includin CVE-2025-83196.1the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL CVE-2025-83208.8Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability. This vulnerability allows network-CVE-2025-83216.8Tesla Wall Connector Firmware Downgrade Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on a CVE-2025-83228.8The e-School from Ventem has a Missing Authorization vulnerability, allowing remote attackers with regular privilege to access administrator CVE-2025-83238.8The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shel CVE-2025-83249.8Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter conf CVE-2025-83258.8The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can in CVE-2025-83269.8A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file CVE-2025-83279.8A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown fun