CVE-2025-3794

Description

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED Reserved 2025-04-18 | Published 2025-05-09 | Updated 2025-05-10 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

Asaf Mozes finder

References

www.wordfence.com/...-e8d8-4918-96e3-e67217771c29?source=cve

plugins.trac.wordpress.org/.../assets/js/frontend/wpforms.js

cve.org (CVE-2025-3794)

nvd.nist.gov (CVE-2025-3794)

Download JSON