{"id":"CVE-2025-3201","aliases":["EUVD-2025-15413","GHSA-qqv4-m5cq-pp99"],"status":"published","title":"Kali Forms \u003c 2.4.3 - Contributor+ Stored XSS","description":"The Contact Form builder with drag \u0026 drop for WordPress  WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00262,"percentile":0.18141,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-05-16T06:00:03Z","modified":"2026-06-17T09:19:24Z","products":[{"vendor":"kaliforms","product":"kali_forms"},{"vendor":"unknown","product":"contact form builder with drag \u0026 drop for wordpress"}],"references":[{"url":"https://wpscan.com/vulnerability/4248289f-36d2-41c5-baf6-bb2c630482ef/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3201"},{"url":"https://wpscan.com/vulnerability/4248289f-36d2-41c5-baf6-bb2c630482ef"},{"url":"https://github.com/advisories/GHSA-qqv4-m5cq-pp99"}],"sources":{"cve":[{"id":"CVE-2025-3201","title":"Kali Forms \u003c 2.4.3 - Contributor+ Stored XSS","description":"The Contact Form builder with drag \u0026 drop for WordPress  WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.","status":"published","published":"2025-05-16T06:00:03.892Z","modified":"2025-05-16T17:29:50.71Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2025-15413","description":"The Contact Form builder with drag \u0026 drop for WordPress  WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.","status":"published","published":"2025-05-16T06:00:03Z","modified":"2025-05-16T17:29:50Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:45.127966Z"}],"ghsa":[{"id":"GHSA-qqv4-m5cq-pp99","title":"The Contact Form builder with drag \u0026 drop for WordPress  WordPress plugin before 2.4.3 does not...","description":"The Contact Form builder with drag \u0026 drop for WordPress  WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.","status":"published","published":"2025-05-16T06:30:24Z","modified":"2025-05-27T21:33:17Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:27.370745Z"}],"nvd":[{"id":"CVE-2025-3201","description":"The Contact Form builder with drag \u0026 drop for WordPress  WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.","status":"published","published":"2025-05-16T06:15:46.253Z","modified":"2026-06-17T09:19:24.837Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:08.321805Z"}]}}