CVE-2025-5730

Easy Contact Form Lite < 1.1.29 - Contributor+ Stored XSS

The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.

Affected

Contact Form Plugin

CVSS v3.1 CNA

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2025-06-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e1e7f423-f981-413c-a99a-e5927fc1cd0c/

Security advisories

• https://wpscan.com/vulnerability/e1e7f423-f981-413c-a99a-e5927fc1cd0c

References

• CVE Record
• NVD entry