Easy Contact Form Lite < 1.1.29 – Contributor+ Stored XSS | CVE 2025-5730 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.

Proof of Concept

1. Login as a Contributor
2. Go to the Easy Form tab and add a new form
3. Select any available form field and insert the XSS payload into the Placeholder input: '</div><img src=x onerror=alert(1)>
4. Save and the XSS will execute every time the form is loaded in WP Admin

Affects Plugins

contact-form-lite

Fixed in 1.1.29

References

CVE

URL

https://research.cleantalk.org/CVE-2025-5730

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krugov Artyom

Submitter

Krugov Aryom

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

e1e7f423-f981-413c-a99a-e5927fc1cd0c

Timeline

Publicly Published

2025-06-09 (about 6 months ago)

Added

2025-06-09 (about 6 months ago)

Last Updated

2025-06-09 (about 6 months ago)

Other

Published

Title

Published

2025-08-20

Title

WP Visitor Statistics (Real Time Traffic) < 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-24

Title

Advanced Sermons < 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-12-07

Title

ClipArt <= 0.2 - Reflected XSS

Published

2021-10-25

Title

Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site Scripting

Published

2024-11-28

Title

Simple Popup <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting