{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12125", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-23T18:27:04.748Z", "datePublished": "2025-11-08T03:27:50.508Z", "dateUpdated": "2026-04-08T17:34:12.801Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:12.801Z"}, "affected": [{"vendor": "linksoftware", "product": "HTML Forms \u2013 Simple WordPress Forms Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.5.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HTML Forms \u2013 Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f99622df-0bf3-4252-8bd3-f84c61fcd39a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390481%40html-forms&new=3390481%40html-forms&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2025-10-24T18:26:31.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T19:30:17.683000Z", "id": "CVE-2025-12125", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T19:45:46.675Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12125", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-10T19:30:17.683000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T19:35:49.965Z"}}], "cna": {"title": "HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "linksoftware", "product": "HTML Forms \u2013 Simple WordPress Forms Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.5.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-24T18:26:31.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-07T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f99622df-0bf3-4252-8bd3-f84c61fcd39a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390481%40html-forms&new=3390481%40html-forms&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The HTML Forms \u2013 Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:12.801Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12125", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:12.801Z", "dateReserved": "2025-10-23T18:27:04.748Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T03:27:50.508Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The HTML Forms \u2013 Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "id": "CVE-2025-12125", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-08T04:15:44.487", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390481%40html-forms&new=3390481%40html-forms&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f99622df-0bf3-4252-8bd3-f84c61fcd39a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:46:34.707797+00:00", "value": {"mitigation_remediation": ["Upgrade the HTML Forms plugin to the latest version (\u2265\u202f1.5.6) to remove the stored XSS vulnerability.", "Ensure the WordPress multi\u2011site network restricts the unfiltered_html capability or remove it from roles that have access to the plugin configuration.", "Re\u2011validate that all admin input fields for the plugin are properly sanitized and HTML\u2011escaped; if the upgrade cannot be performed immediately, temporarily restrict or disable the plugin to prevent the insertion of malicious scripts."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "This vulnerability affects installations of the LinkSoftware HTML Forms \u2013 Simple WordPress Forms Plugin for WordPress version 1.5.5 and earlier, specifically on multi\u2011site WordPress networks where the unfiltered_html capability is disabled. Any site running these versions on a multi\u2011site setup is susceptible if an attacker has administrative access.", "description_and_impact": "The HTML Forms \u2013 Simple WordPress Forms Plugin contains a stored cross\u2011site scripting flaw that originates from insufficient input sanitization and output escaping in the admin settings interface. An attacker who is already authenticated with administrator\u2011level or higher privileges can inject arbitrary JavaScript into the plugin configuration, which then persists and executes whenever a site visitor loads the affected page. This can lead to session hijacking, credential theft, defacement, or other client\u2011side attacks against users of the site.", "risk_and_exploitability": "The flaw has a CVSS score of 4.4, indicating a low to moderate severity, and an EPSS score of less than 1\u202f%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires administrative privileges and a multi\u2011site environment with unfiltered_html disabled, making the attack vector authenticated and limited. Nevertheless, the impact on end\u2011user browsers can be significant, and the low exploit likelihood does not mitigate the need for remediation."}}}}, "created": "2025-11-10T09:33:27.451853+00:00", "updated": "2026-04-21T02:00:12.271516+00:00", "vendors": ["linksoftware", "linksoftware$PRODUCT$html_forms", "wordpress", "wordpress$PRODUCT$wordpress"]}