CVE-2025-15705

{
  "etk_id": "ETK-2026-2582",
  "cve_id": "CVE-2025-15705",
  "display_id": "CVE-2025-15705",
  "ghsa_id": "GHSA-3f2v-jx9m-xwjg",
  "euvd_id": "EUVD-2025-211198",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Contact Form by Supsystic",
  "summary": "Contact Form by Supsystic versions before 1.8.0 are affected by stored cross-site scripting through form names. An attacker with form-editor access can cause script to run in another user's browser when that user views the modified form. Multisite sites may expose administrators without unrestricted HTML capability to this impact.",
  "mitigation": "Upgrade Contact Form by Supsystic to version 1.8.0 or later. Until upgraded, restrict form-editor access to trusted users and review existing form names for untrusted content.",
  "vendor": null,
  "product": "Contact Form by Supsystic",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.8.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.8.0"
      ],
      "package_name": "Contact Form by Supsystic",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 48.70514285,
  "t0_at": "2026-10-25T06:00:19.597000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-25T08:13:46.338381+00:00",
      "days": 0.09267061783564814,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T06:00:19.597000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-25T06:00:19.597000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T06:00:19.597000+00:00",
      "url": "https://github.com/advisories/GHSA-3f2v-jx9m-xwjg"
    }
  }
}