CVE-2025-6740

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6740", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-26T17:02:50.234Z", "datePublished": "2025-07-04T11:18:24.720Z", "dateUpdated": "2026-04-08T16:32:27.651Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:32:27.651Z"}, "affected": [{"vendor": "arshidkv12", "product": "Database Addon for Contact Form 7 \u2013 CFDB7", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018tmpD\u2019 parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/014803c8-3319-48ad-98c7-d1f372d37ff2?source=cve"}, {"url": "https://wordpress.org/plugins/contact-form-cfdb7/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.3.1/contact-form-cfdb-7.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3320134/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Tan Phat"}], "timeline": [{"time": "2025-07-03T21:37:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-07T14:38:10.313539Z", "id": "CVE-2025-6740", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-07T14:57:35.433Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6740", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-07T14:38:10.313539Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-07T14:40:32.547Z"}}], "cna": {"title": "Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Tan Phat"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "arshidkv12", "product": "Database Addon for Contact Form 7 \u2013 CFDB7", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-03T21:37:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/014803c8-3319-48ad-98c7-d1f372d37ff2?source=cve"}, {"url": "https://wordpress.org/plugins/contact-form-cfdb7/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.3.1/contact-form-cfdb-7.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3320134/"}], "descriptions": [{"lang": "en", "value": "The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018tmpD\u2019 parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:32:27.651Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6740", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:32:27.651Z", "dateReserved": "2025-06-26T17:02:50.234Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-04T11:18:24.720Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Database Addon for Contact Form 7 \u2013 CFDB7", "vendor": "arshidkv12", "versions": [{"lessThanOrEqual": "1.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ciphercoin:contact_form_7_database_addon:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "3E0D72C4-920B-4261-8F10-3E50F1164F1D", "versionEndExcluding": "1.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018tmpD\u2019 parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Contact Form 7 Database Addon para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del par\u00e1metro 'tmpD' en todas las versiones hasta la 1.3.1 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-6740", "lastModified": "2026-06-17T10:02:28.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6740", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-07T14:38:10.313539Z", "version": "2.0.3"}}]}, "published": "2025-07-04T12:15:35.570", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/contact-form-cfdb7/tags/1.3.1/contact-form-cfdb-7.php"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3320134/"}, {"source": "security@wordfence.com", "tags": ["Product", "Release Notes"], "url": "https://wordpress.org/plugins/contact-form-cfdb7/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/014803c8-3319-48ad-98c7-d1f372d37ff2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:08:10.628989+00:00", "value": {"mitigation_remediation": ["Upgrade Contact Form 7 Database Addon to a version newer than 1.3.1.", "If upgrading is not possible, disable or uninstall the plugin to eliminate the risk.", "Ensure that the plugin\u2019s handling of the tmpD parameter properly sanitizes input and escapes output before storage and rendering."], "summary": {"action": "Apply patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that employ the Database Addon for Contact Form 7 \u2013 CFDB7 plugin produced by arshidkv12. Versions up to and including 1.3.1 are impacted; later releases are presumed fixed.", "description_and_impact": "The Contact Form 7 Database Addon for WordPress is vulnerable to stored cross\u2011site scripting via the tmpD parameter in all versions up to and including 1.3.1 because the plugin does not properly sanitize or escape the input before storing it. An unauthenticated attacker can place arbitrary JavaScript in tmpD that is persisted in the database and will run in a visitor\u2019s browser whenever the affected page is displayed.", "risk_and_exploitability": "The CVSS score of 6.1 places the issue in the medium\u2011severity range. The EPSS score of less than 1% indicates that exploitation in the wild is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. An attacker would issue a web\u2011based request containing malicious data in the tmpD parameter without needing authentication; the stored script would then execute in the browsers of any user visiting the page where the data is displayed."}}}}, "created": "2026-04-22T17:15:22.199864+00:00", "updated": "2026-04-22T17:15:22.199882+00:00", "vendors": []}