{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3794", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-18T13:15:28.271Z", "datePublished": "2025-05-09T22:22:12.702Z", "dateUpdated": "2026-04-08T16:37:26.882Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:26.882Z"}, "affected": [{"vendor": "smub", "product": "WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, & More", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/179eb680-e8d8-4918-96e3-e67217771c29?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.4.2/assets/js/frontend/wpforms.js#L3154"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Asaf Mozes"}], "timeline": [{"time": "2025-04-14T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-05-09T10:00:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-10T01:35:44.701113Z", "id": "CVE-2025-3794", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-10T01:36:07.885Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3794", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-10T01:35:44.701113Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-10T01:36:02.944Z"}}], "cna": {"title": "WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Asaf Mozes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "smub", "product": "WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, & More", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-14T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-05-09T10:00:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/179eb680-e8d8-4918-96e3-e67217771c29?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.4.2/assets/js/frontend/wpforms.js#L3154"}], "descriptions": [{"lang": "en", "value": "The WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:26.882Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3794", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:26.882Z", "dateReserved": "2025-04-18T13:15:28.271Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-09T22:22:12.702Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, &amp; More para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del par\u00e1metro start_timestamp en todas las versiones hasta la 1.9.5 incluida, debido a una depuraci\u00f3nde entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3794", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-05-09T23:15:50.780", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.4.2/assets/js/frontend/wpforms.js#L3154"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/179eb680-e8d8-4918-96e3-e67217771c29?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:21:32.635552+00:00", "value": {"mitigation_remediation": ["Upgrade WPForms Lite to version 1.9.6 or newer, which includes proper sanitization of the start_timestamp parameter.", "Remove or cleanse existing form entries that contain suspicious start_timestamp values to eradicate stored malicious scripts.", "Restrict Contributor\u2010level access to trusted personnel and enforce strict code\u2011review practices for form configurations."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have installed the WPForms Lite plugin up to and including version 1.9.5 are affected. The plugin is distributed by smub under the name \"WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, & More\". Any installation that has not upgraded beyond 1.9.5 must assess whether the start_timestamp parameter has been used in stored form data.", "description_and_impact": "The WPForms \"Easy Form Builder\" plugin for WordPress contains a stored XSS flaw that lets authenticated users with Contributor privileges or higher inject arbitrary JavaScript through the start_timestamp parameter. Because the value is stored with the form and served to visitors without proper filtering, any user who opens a page containing that form will have the malicious script executed in their browser. This can lead to session hijacking, defacement, or the delivery of malware to site visitors. The weakness arises from insufficient input sanitization and a lack of output escaping, and is classified as a classic Cross\u2011Site Scripting fault.", "risk_and_exploitability": "The CVSS base score of 5.4 indicates moderate severity. The EPSS score is listed as less than 1%, so exploitation in the wild is unlikely at present. The flaw requires only Contributor\u2011level authentication, making compromise accessible to a wide set of users who normally have content\u2011authoring rights. Because it is a stored XSS, the attack vector is an authenticated interaction with the plugin\u2019s form editor where the malicious payload can be inserted into the start_timestamp field. The vulnerability is not currently listed in the CISA KEV catalog, so it is not known to be actively used by major threat actors, but any successful exploitation would affect all visitors who load the compromised form pages."}}}}, "created": "2026-04-22T17:30:22.633389+00:00", "updated": "2026-04-22T17:30:22.633400+00:00", "vendors": []}