CVE-2025-15028 wpwax CVE debrief

Who should care

Administrators of WordPress installations using the FormGent plugin, as well as users who may be affected by the vulnerability, should take immediate action to apply the latest patch and review their security measures. This includes reviewing and updating input sanitization and output escaping, monitoring for suspicious activity, and considering implementing additional security measures. The vulnerability's public exploitability and potential for significant impact make it a high priority for affected operators, platforms, vulnerability-management teams, and security teams to address.

Technical summary

The FormGent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2. The vulnerability exists due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. This vulnerability can be exploited by attackers to inject malicious scripts into pages, which will execute when a user accesses the injected page. The vulnerability has a CVSS score of 7.2 and is classified as HIGH severity.

Defensive priority

High priority due to public exploitability and potential for significant impact.

Recommended defensive actions

• Apply the latest patch
• Review and update input sanitization and output escaping
• Monitor for suspicious activity
• Consider implementing additional security measures
• Conduct a thorough risk assessment

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.2 and severity of HIGH. However, further information about the vendor and affected products is limited.

Official resources