{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8783", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-09T00:35:34.733Z", "datePublished": "2025-08-19T10:57:28.201Z", "dateUpdated": "2026-04-08T17:03:05.907Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:05.907Z"}, "affected": [{"vendor": "kleor", "product": "Contact Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.6.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title\u2019 parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Contact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e52a487-8e87-49b7-a044-9fb8452f3dd1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-manager/trunk/admin-pages-functions.php#L524"}, {"url": "https://plugins.trac.wordpress.org/changeset/3345750/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-08-13T17:22:23.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-18T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-19T13:16:37.396695Z", "id": "CVE-2025-8783", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-19T13:16:42.582Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8783", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-19T13:16:37.396695Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-19T13:16:39.327Z"}}], "cna": {"title": "Contact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "kleor", "product": "Contact Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.6.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-13T17:22:23.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-18T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e52a487-8e87-49b7-a044-9fb8452f3dd1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-manager/trunk/admin-pages-functions.php#L524"}, {"url": "https://plugins.trac.wordpress.org/changeset/3345750/"}], "descriptions": [{"lang": "en", "value": "The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title\u2019 parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:05.907Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8783", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:05.907Z", "dateReserved": "2025-08-09T00:35:34.733Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-19T10:57:28.201Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title\u2019 parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El complemento Contact Manager para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro \"title\" en todas las versiones hasta la 8.6.5 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de administrador, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-8783", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-08-19T11:15:28.830", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/contact-manager/trunk/admin-pages-functions.php#L524"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3345750/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e52a487-8e87-49b7-a044-9fb8452f3dd1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:26:46.380455+00:00", "value": {"mitigation_remediation": ["Upgrade the Contact Manager plugin to a version later than 8.6.5 where the input validation issue has been fixed.", "If upgrading is not feasible, disable or strip the title field in the admin page, or apply a custom filter that properly sanitizes and escapes the title before rendering.", "Ensure that the WordPress unfiltered_html capability is disabled for all users, thereby preventing unfiltered content from bypassing sanitization safeguards."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting that affect pages viewed by users"}, "threat_synthesis": {"affected_systems": "The flaw exists in all versions of the kleor Contact Manager plugin up to and including 8.6.5 executed on WordPress installations that are either multi\u2011site or have unfiltered_html disabled. Versions later than 8.6.5 are not affected and are recommended for safe operation.", "description_and_impact": "The Contact Manager plugin contains a stored XSS flaw in the title field owing to insufficient sanitization and escape handling. The bug allows an authenticated administrator to embed arbitrary scripts that are executed whenever a user accesses a page containing the injected content, potentially leading to data theft, session hijacking, or defacement. The vulnerability is confined to the injection point and does not offer remote code execution, but any user who views the compromised page can be impacted.", "risk_and_exploitability": "The CVSS score of 4.4 classifies the bug as low to medium severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The bug is not listed in the CISA KEV catalog. Exploitation requires administrator\u2011level credentials; the attacker must access the admin interface to insert malicious input and then entice other users to view the page containing the embedded script. Boundaries of the attack are therefore limited to the site scope and user base that accesses the affected content."}}}}, "created": "2025-08-21T12:32:02.463343+00:00", "updated": "2026-04-21T03:30:26.337559+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}