PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-15028 wpwax CVE debrief

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor
wpwax
Product
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-08-06
Advisory published
2026-08-06
Advisory updated
2026-08-06

Who should care

Administrators of WordPress installations using the FormGent plugin, as well as users who may be affected by the vulnerability, should take immediate action to apply the latest patch and review their security measures. This includes reviewing and updating input sanitization and output escaping, monitoring for suspicious activity, and considering implementing additional security measures. The vulnerability's public exploitability and potential for significant impact make it a high priority for affected operators, platforms, vulnerability-management teams, and security teams to address.

Technical summary

The FormGent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2. The vulnerability exists due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. This vulnerability can be exploited by attackers to inject malicious scripts into pages, which will execute when a user accesses the injected page. The vulnerability has a CVSS score of 7.2 and is classified as HIGH severity.

Defensive priority

High priority due to public exploitability and potential for significant impact.

Recommended defensive actions

  • Apply the latest patch
  • Review and update input sanitization and output escaping
  • Monitor for suspicious activity
  • Consider implementing additional security measures
  • Conduct a thorough risk assessment

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.2 and severity of HIGH. However, further information about the vendor and affected products is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-15028 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-15028

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-15028 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-15028

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.