CVE-2025-0817

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0817", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-28T21:03:19.234Z", "datePublished": "2025-02-18T11:10:19.710Z", "dateUpdated": "2026-04-08T17:02:25.481Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:25.481Z"}, "affected": [{"vendor": "FormCraft", "product": "FormCraft", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "title": "FormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae0710a-8c9b-41b0-860f-ae79b7ed1ee4?source=cve"}, {"url": "https://codecanyon.net/item/formcraft-premium-wordpress-form-builder/5335056"}, {"url": "https://formcraft-wp.com/changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Khayal Farzaliyev"}], "timeline": [{"time": "2025-01-29T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-02-17T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-18T14:20:05.417806Z", "id": "CVE-2025-0817", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T14:20:37.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0817", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-18T14:20:05.417806Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T14:20:12.694Z"}}], "cna": {"title": "FormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Khayal Farzaliyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "FormCraft", "product": "FormCraft", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.9.11"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-29T00:00:00.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-02-17T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae0710a-8c9b-41b0-860f-ae79b7ed1ee4?source=cve"}, {"url": "https://codecanyon.net/item/formcraft-premium-wordpress-form-builder/5335056"}, {"url": "https://formcraft-wp.com/changelog/"}], "descriptions": [{"lang": "en", "value": "The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-02-18T11:10:19.710Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0817", "state": "PUBLISHED", "dateUpdated": "2025-02-18T14:20:37.194Z", "dateReserved": "2025-01-28T21:03:19.234Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-18T11:10:19.710Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FormCraft", "vendor": "FormCraft", "versions": [{"lessThanOrEqual": "3.9.11", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ncrafts:formcraft:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "8DB20998-2100-4457-A89C-B39832638855", "versionEndExcluding": "3.9.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."}, {"lang": "es", "value": "El complemento FormCraft para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de cargas de archivo SVG en todas las versiones hasta 3.9.11 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida. Esto hace posible que los atacantes no autenticados inyecten una web arbitraria scripts en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda al archivo SVG."}], "id": "CVE-2025-0817", "lastModified": "2026-06-17T08:27:11.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0817", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-18T14:20:05.417806Z", "version": "2.0.3"}}]}, "published": "2025-02-18T11:15:12.893", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://codecanyon.net/item/formcraft-premium-wordpress-form-builder/5335056"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://formcraft-wp.com/changelog/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae0710a-8c9b-41b0-860f-ae79b7ed1ee4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:58:37.205185+00:00", "value": {"mitigation_remediation": ["Update FormCraft to the latest release (\u2265\u202f3.10) that removes or sanitises SVG uploads", "If an update is not feasible, disable SVG file uploads in the form settings or block .svg MIME types via server configuration or .htaccess rules", "As a temporary defense, restrict file uploads to only safe types such as PNG or JPEG, and consider implementing a content security policy that blocks script execution from uploaded content"], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting via SVG uploads"}, "threat_synthesis": {"affected_systems": "The flaw exists in all FormCraft plugin releases up to and including version 3.9.11. The affected product is the FormCraft Premium WordPress Form Builder provided by Ncrafts. The plugin runs within a WordPress environment; any installation hosting the plugin and permitting SVG uploads is vulnerable.", "description_and_impact": "The FormCraft WordPress plugin allows users to upload SVG files without proper input sanitisation or output escaping. An unauthenticated attacker can therefore embed arbitrary JavaScript within an SVG file. When any site visitor views or downloads the SVG, the injected script executes in the victim\u2019s browser, enabling typical XSS consequences such as session hijacking, defacement or data theft. This vulnerability is characterised as Stored XSS (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity, with the EPSS score of less than 1% suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is unauthenticated file upload: an attacker simply submits an SVG via the form builder\u2019s file upload interface; once stored, the payload will execute whenever any logged\u2011in or anonymous user accesses the SVG file. No special authentication or privilege is required, which widens the threat surface."}}}}, "created": "2026-04-22T15:00:05.630201+00:00", "updated": "2026-04-22T15:00:05.630213+00:00", "vendors": []}