Is CVE-2025-15705 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15705 being exploited in the wild.

How severe is CVE-2025-15705?

Informational severity, published 25 October 2026.

Which products and versions are affected?

Supsystic Contact Form before 1.8.0.

Is there a fix for CVE-2025-15705?

Yes: fixed in 1.8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-15705 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-15705?

Check whether you run Supsystic Contact Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15705: Contact Form by Supsystic stored XSS in form name

CVE-2025-15705 · Severity: info · Published 2026-10-25

The Contact Form by Supsystic WordPress plugin fails to properly sanitize form names, allowing users with form editor access to inject malicious scripts. When another user views the affected form, the injected script executes in their browser, potentially stealing credentials or session data. On WordPress multisite installations where admins lack the unfiltered_html capability, this vulnerability crosses privilege boundaries and poses a higher risk.

Technologies: Supsystic Contact Form. Vendors: Supsystic.

Quick answers

Is CVE-2025-15705 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15705 being exploited in the wild.
How severe is CVE-2025-15705?: Informational severity, published 25 October 2026.
Which products and versions are affected?: Supsystic Contact Form before 1.8.0.
Is there a fix for CVE-2025-15705?: Yes: fixed in 1.8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-15705 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-15705?: Check whether you run Supsystic Contact Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.8.0

Technical details

This is a stored cross-site scripting (XSS) vulnerability in the form name field that lacks proper input sanitization and output escaping. An authenticated user with access to the form editor can inject arbitrary JavaScript into a form name, which persists in the database and executes when other users view or interact with the form. On multisite installations where admins are restricted from the unfiltered_html capability, lower-privileged editors can exploit this to execute scripts with admin-level consequences.

Affected products

Supsystic Contact Form before 1.8.0

Timeline

2026-10-23: disclosed
2026-10-25: patched: Version 1.8.0 released

References

https://wpscan.com/vulnerability/7b592632-614d-4792-8372-a38e667e547b/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.