CVE-2025-0470

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0470", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-14T12:38:42.715Z", "datePublished": "2025-01-31T03:21:28.615Z", "dateUpdated": "2026-04-08T17:33:17.289Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:17.289Z"}, "affected": [{"vendor": "wpmudev", "product": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.38.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5281d4b-c2cd-4972-b837-e101a8893c6e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.38.2/requirejs/main.js"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3226716%40forminator%2Ftrunk&old=3222217%40forminator%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Asaf Mozes"}], "timeline": [{"time": "2024-12-24T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-01-30T15:07:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-31T16:52:11.994324Z", "id": "CVE-2025-0470", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-31T16:52:29.378Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0470", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-31T16:52:11.994324Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-31T16:51:40.508Z"}}], "cna": {"title": "Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Asaf Mozes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpmudev", "product": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.38.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-12-24T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-01-30T15:07:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5281d4b-c2cd-4972-b837-e101a8893c6e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.38.2/requirejs/main.js"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3226716%40forminator%2Ftrunk&old=3222217%40forminator%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:17.289Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0470", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:17.289Z", "dateReserved": "2025-01-14T12:38:42.715Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-01-31T03:21:28.615Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder", "vendor": "wpmudev", "versions": [{"lessThanOrEqual": "1.38.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpmudev:forminator_forms:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "AF95E29C-6BD1-4798-B8C8-60EA963C2A59", "versionEndExcluding": "1.38.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Forminator Forms \u2013 Contact Form, Payment Form &amp; Custom Form Builder para WordPress es vulnerable a Cross-Site Scripting Reflejado a trav\u00e9s del par\u00e1metro de t\u00edtulo en todas las versiones hasta la 1.38.2 y incluida, debido a un escape de entrada desinfecci\u00f3n y de salida insuficiente. Esto permite que atacantes no autenticados inyecten scripts web arbitraria en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-0470", "lastModified": "2026-06-17T08:26:32.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0470", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-31T16:52:11.994324Z", "version": "2.0.3"}}]}, "published": "2025-01-31T04:15:09.053", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.38.2/requirejs/main.js"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3226716%40forminator%2Ftrunk&old=3222217%40forminator%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5281d4b-c2cd-4972-b837-e101a8893c6e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:26:25.147889+00:00", "value": {"mitigation_remediation": ["Upgrade the Forminator plugin to the latest release that removes the unsanitized title handling.", "If an upgrade cannot be performed immediately, add a custom filter to sanitize the title parameter (e.g., strip or escape script tags using WordPress\u2019s sanitize_text_field or wp_kses before output).", "Configure a Web Application Firewall or security plugin to block or sanitize requests that contain script tags in the title value."], "summary": {"action": "Patch", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All instances of the Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin released by WPMUDEV up to and including version 1.38.2 are impacted. Any WordPress site deploying these releases is susceptible to the reflected XSS flaw.", "description_and_impact": "The Forminator plugin includes a flaw that allows unauthenticated attackers to embed malicious scripts via the title parameter. Unsanitized input is added directly to the page output, enabling the injection of arbitrary JavaScript. Attackers can leverage this by crafting a link or message that a victim clicks, at which point the malicious code executes in the victim\u2019s browser, potentially leading to defacement, phishing, or session hijacking.", "risk_and_exploitability": "The CVSS score is 6.1 and the EPSS score indicates a very low exploitation probability (<1%). Attackers do not need authenticated access, but they must entice a user into clicking a crafted URL or link that supplies a malicious title value. The vulnerability is not listed in the CISA KEV catalog, so there are currently no large\u2011scale exploitation reports."}}}}, "created": "2026-04-21T22:30:06.136500+00:00", "updated": "2026-04-21T22:30:06.136516+00:00", "vendors": []}