CVE-2025-12834

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12834", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-06T19:56:54.747Z", "datePublished": "2025-12-12T03:20:59.271Z", "dateUpdated": "2026-04-08T17:27:15.042Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:15.042Z"}, "affected": [{"vendor": "zealopensource", "product": "Accept Stripe Payments Using Contact Form 7", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_message", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e77e3f-dcd8-426a-be0f-24eb65c6709e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/accept-stripe-payments-using-contact-form-7/tags/3.1/inc/lib/class.cf7sa.lib.php#L696"}, {"url": "https://plugins.trac.wordpress.org/changeset/3418155/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-12-11T14:24:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T18:40:08.667677Z", "id": "CVE-2025-12834", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T18:40:20.665Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12834", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T18:40:08.667677Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T18:40:15.242Z"}}], "cna": {"title": "Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_message", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "zealopensource", "product": "Accept Stripe Payments Using Contact Form 7", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T14:24:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e77e3f-dcd8-426a-be0f-24eb65c6709e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/accept-stripe-payments-using-contact-form-7/tags/3.1/inc/lib/class.cf7sa.lib.php#L696"}, {"url": "https://plugins.trac.wordpress.org/changeset/3418155/"}], "descriptions": [{"lang": "en", "value": "The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:15.042Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12834", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:15.042Z", "dateReserved": "2025-11-06T19:56:54.747Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:20:59.271Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Accept Stripe Payments Using Contact Form 7", "vendor": "zealopensource", "versions": [{"lessThanOrEqual": "3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Accept Stripe Payments Using Contact Form 7 para WordPress es vulnerable a cross-site scripting reflejado a trav\u00e9s del par\u00e1metro 'failure_message' en versiones hasta la 3.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-12834", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12834", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T18:40:08.667677Z", "version": "2.0.3"}}]}, "published": "2025-12-12T04:15:40.300", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/accept-stripe-payments-using-contact-form-7/tags/3.1/inc/lib/class.cf7sa.lib.php#L696"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3418155/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e77e3f-dcd8-426a-be0f-24eb65c6709e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:52:26.840124+00:00", "value": {"mitigation_remediation": ["Upgrade the Accept Stripe Payments Using Contact Form 7 plugin to the latest version that includes the fix for the failure_message XSS vulnerability.", "If an upgrade is not immediately possible, temporarily disable or sanitize the failure_message output so that any user\u2011supplied content is properly escaped before rendering.", "Deploy a strict content security policy (CSP) that restricts script execution to trusted origins to mitigate the impact of any remaining reflected XSS attempts."], "summary": {"action": "Apply Patch", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Affecting the Zealopensource Accept Stripe Payments Using Contact Form 7 plugin for WordPress, all releases up to and including version 3.1 are vulnerable. The issue is tied to the failure_message field processing in the plugin code.", "description_and_impact": "The Accept Stripe Payments Using Contact Form 7 plugin contains a reflected cross\u2011site scripting vulnerability that arises from insufficient input sanitization and output escaping when the failure_message parameter is processed. An unauthenticated attacker can inject arbitrary scripts into page output by submitting a crafted value, and those scripts will execute whenever a user views the page or follows a link that triggers the failure_message response. This flaw enables attackers to deface the site, steal session cookies, or phish users, thereby compromising confidentiality, integrity, and potentially availability of the affected site.", "risk_and_exploitability": "The CVSS base score is 6.1, indicating a moderate severity. The EPSS score of <1% suggests that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack vector typically requires the attacker to lure a user into clicking a malicious link that embeds an crafted failure_message payload, leading to script execution within the victim\u2019s browser. Monitoring of the plugin\u2019s origin, version, and potential input vectors is advised due to the user\u2011involved nature of the exploit."}}}}, "created": "2025-12-12T08:47:48.581172+00:00", "updated": "2026-04-21T01:00:12.960864+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "zealousweb", "zealousweb$PRODUCT$accept_stripe_payments_using_contact_form_7"]}