CVE-2025-15669
Last modified
CVE-2025-15669 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form..
Description
The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Bit Form | < 3.1.4 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-15669?
How severe is CVE-2025-15669?
How do I fix CVE-2025-15669?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-15663The Ultimate Before After Image Slider & Gallery WordPress …6.8
- CVE-2025-15664The Ultimate Before After Image Slider & Gallery WordPress …6.8
- CVE-2025-15665The Ultimate Before After Image Slider & Gallery WordPress …5.4
- CVE-2025-15666A security vulnerability has been detected in Open Asset Imp…5.3
- CVE-2025-15667A vulnerability was determined in GPAC up to 2.5-DEV. This v…3.3
- CVE-2025-15668A vulnerability was identified in GPAC up to b40ce70f5. This…3.3
- CVE-2025-15671The Welcart e-Commerce WordPress plugin before 2.12.1 does n…5.4
- CVE-2025-15672The ChamaWP WordPress plugin before 1.0.13 does not properl…8.1
- CVE-2025-15673The Import and export users and customers WordPress plugin b…4.9
- CVE-2025-15674The Passster WordPress plugin before 4.3.7 does not restrict…2.7
- CVE-2025-15675The Charitable WordPress plugin before 1.8.5.3 does not san…4.8
- CVE-2025-15677The GeoDirectory WordPress plugin before 2.8.110 does not s…3.5
Are you affected by CVE-2025-15669?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST