CVE-2025-13861
Last modified
CVE-2025-13861 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The HTML Forms – Simple WordPress Forms Plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.0 due to insufficient sanitization of fabricated file upload field metadata before displaying it in the WordPress admin dashboard. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator accesses the form submissions page.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
The HTML Forms – Simple WordPress Forms Plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.0 due to insufficient sanitization of fabricated file upload field metadata before displaying it in the WordPress admin dashboard. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator accesses the form submissions page.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-13861?
How severe is CVE-2025-13861?
How do I fix CVE-2025-13861?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-13855IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Se…8.8
- CVE-2025-13856The Extra Post Images plugin for WordPress is vulnerable to …6.4
- CVE-2025-13857The Yet Another WebClap for WordPress plugin for WordPress i…6.4
- CVE-2025-13859The AffiliateX – Amazon Affiliate Plugin plugin for WordPres…6.4
- CVE-2025-1386When using the ch-go library, under a specific condition whe…4.9
- CVE-2025-13860The Easy Jump Links Menus plugin for WordPress is vulnerable…6.4
- CVE-2025-13862The Menu Card plugin for WordPress is vulnerable to Stored C…6.4
- CVE-2025-13863The RevInsite plugin for WordPress is vulnerable to Stored C…6.4
- CVE-2025-13864The Breeze - WordPress Cache Plugin plugin for WordPress is …5.3
- CVE-2025-13866The Flow-Flow Social Feed Stream plugin for WordPress is vul…6.4
- CVE-2025-13867IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Se…6.5
- CVE-2025-1387Orca HCM from LEARNING DIGITAL has an Improper Authenticatio…9.8
Are you affected by CVE-2025-13861?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST