CVE-2025-13861mediumCWE-79

CVE-2025-13861: medium-severity vulnerability in linksoftware HTML Forms – Simple WordPress…

HTML Forms – Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor HTML Forms – Simple WordPress Forms Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.3%
The HTML Forms – Simple WordPress Forms Plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.0 due to insufficient sanitization of fabricated file upload field metadata before displaying it in the WordPress admin dashboard. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator accesses the form submissions page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
linksoftware · HTML Forms – Simple WordPress Forms Plugin
Related CVEs — linksoftware HTML Forms – Simple WordPress…

In the same product, most dangerous first.

CVE-2025-12125MEDIUMHTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%