WordPress Security Bulletin: HTML Forms – Simple WordPress Forms Plugin Vulnerability (CVE-2025-13861)

Security Alert Summary

The HTML Forms – Simple WordPress Forms Plugin for WordPress contains an unauthenticated stored cross-site scripting (XSS) vulnerability that allows an attacker to inject scripts into form submission metadata. Injected scripts can execute when an administrator views the form submissions page in the WordPress dashboard.

CVE Details

• CVE ID: CVE-2025-13861
• Affected component: HTML Forms – Simple WordPress Forms Plugin for WordPress (as stated in the CVE description)
• Affected versions: All versions up to and including 1.6.0 (as stated in the CVE description)
• Published: December 17, 2025 at 5:16:10 AM UTC
• Last modified: December 17, 2025 at 5:16:10 AM UTC
• CVSS v3.1: Base score 6.1 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Authentication / privileges / user interaction:
  • Privileges required: NONE
  • User interaction: REQUIRED (an admin must view the submissions page)
  • Attack vector: NETWORK; Attack complexity: LOW; Scope: CHANGED
• Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
• Weakness (CWE): CWE-79 (Cross-site Scripting)

Technical Details

According to the CVE entry, the plugin fails to sufficiently sanitize fabricated file upload field metadata before displaying it in the WordPress admin dashboard. This allows an unauthenticated attacker to store malicious script content in submission metadata that is later rendered in pages the administrator views. The description indicates the issue is in how file upload field metadata is processed and displayed (references point to the plugin’s functions.php), resulting in stored XSS that triggers when an admin opens the form submissions page.

The vulnerability is a stored XSS: the attacker supplies payloads via form submission metadata, those payloads are saved by the plugin, and they are executed in the context of an administrator’s browser when the submissions are displayed. The CVE data does not specify exact function names beyond references to the plugin’s functions.php or provide a fixed version; it only describes insufficient sanitization of file upload metadata.

How This Could Impact Your Website

Consider a small organization where an external contractor or public user submits form data that includes file upload metadata. If the plugin accepts fabricated metadata and stores it, an attacker could embed a script that executes when an internal staff member with administrator privileges views the submissions. Practical consequences include limited exposure of information accessible to the administrator’s browser (for example, data visible on the submissions page) and the potential for targeted actions such as harvesting administrator-visible contact details or performing actions that rely on the administrator’s browser session.

Because the CVSS impact is listed as Low for confidentiality and integrity and None for availability, this does not imply automatic full-site compromise; the primary risk is attacker-controlled script execution in an administrator’s browser context when viewing submissions. This can increase the risk of targeted phishing or social engineering that leverages exposed or inferred contact details.

If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

• Update the affected plugin as soon as a patched version is available (CVE does not specify a fixed version).
• Review and reduce unnecessary user roles, especially contributors and accounts that can upload content or view submissions.
• Enforce strong passwords and two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins and limit who can install or modify plugins.
• Monitor site activity and admin sessions for unusual behavior, and review recent form submissions for unexpected metadata.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/browser/html-forms/trunk/src/functions.php#L321
• https://plugins.trac.wordpress.org/browser/html-forms/trunk/src/functions.php#L357
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3419926%40html-forms%2Ftrunk&old=3407043%40html-forms%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/52e2f1b9-d240-4813-9124-51bd6b047553?source=cve