CVE-2025-8315

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8315", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-29T20:35:49.918Z", "datePublished": "2025-08-05T06:39:48.070Z", "dateUpdated": "2026-04-08T16:41:43.296Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:43.296Z"}, "affected": [{"vendor": "emarket-design", "product": "Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018noaccess_msg\u2019 parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229c88ea-c091-43b6-ac4d-31bccdd13a07?source=cve"}, {"url": "https://plugins.svn.wordpress.org/wp-easy-contact/tags/4.0.1/includes/emd-form-builder-lite/emd-form-frontend.php"}, {"url": "https://wordpress.org/plugins/wp-easy-contact/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3337661"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-07-30T08:23:06.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-04T17:36:03.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-05T13:23:11.868848Z", "id": "CVE-2025-8315", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-05T13:23:20.107Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8315", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-05T13:23:11.868848Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-05T13:23:16.032Z"}}], "cna": {"title": "WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "emarket-design", "product": "Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.0.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-30T08:23:06.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-04T17:36:03.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229c88ea-c091-43b6-ac4d-31bccdd13a07?source=cve"}, {"url": "https://plugins.svn.wordpress.org/wp-easy-contact/tags/4.0.1/includes/emd-form-builder-lite/emd-form-frontend.php"}, {"url": "https://wordpress.org/plugins/wp-easy-contact/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3337661"}], "descriptions": [{"lang": "en", "value": "The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018noaccess_msg\u2019 parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:43.296Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8315", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:43.296Z", "dateReserved": "2025-07-29T20:35:49.918Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-05T06:39:48.070Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact", "vendor": "emarket-design", "versions": [{"lessThanOrEqual": "4.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018noaccess_msg\u2019 parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento WP Easy Contact para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'noaccess_msg' en todas las versiones hasta la 4.0.1 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-8315", "lastModified": "2026-06-17T10:06:43.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8315", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-05T13:23:11.868848Z", "version": "2.0.3"}}]}, "published": "2025-08-05T07:15:35.423", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/wp-easy-contact/tags/4.0.1/includes/emd-form-builder-lite/emd-form-frontend.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3337661"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wp-easy-contact/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229c88ea-c091-43b6-ac4d-31bccdd13a07?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:02:18.111097+00:00", "value": {"mitigation_remediation": ["Apply the latest plugin update to eliminate the vulnerable input handling.", "Restrict or remove Contributor\u2011level permissions for unverified or untrusted users, or disable the noaccess_msg feature if the plugin allows it.", "Sanitize or delete existing noaccess_msg entries that contain user\u2011supplied content, and replace them with plain text or properly escaped data."], "summary": {"action": "Update", "impact": "Stored Cross\u2011Site Scripting by authenticated contributors"}, "threat_synthesis": {"affected_systems": "The Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact, developed by emarket\u2011design, is affected in all releases up to and including version\u202f4.0.1.", "description_and_impact": "The WP Easy Contact plugin is vulnerable to stored cross\u2011site scripting through the noaccess_msg parameter. Authenticated users with Contributor-level or higher privileges can inject arbitrary JavaScript into this field, and the content is stored and later rendered without proper sanitization or escaping. When a user accesses a page that includes the stored message, the browser executes the injected script.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity vulnerability, and the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with Contributor or higher privileges and to submit a crafted noaccess_msg via the plugin interface. Once stored, the script executes automatically for any visitor of the affected page."}}}}, "created": "2025-08-05T21:23:03.795573+00:00", "updated": "2026-04-22T17:15:22.191170+00:00", "vendors": ["emarketdesign", "emarketdesign$PRODUCT$wp_easy_contact", "wordpress", "wordpress$PRODUCT$wordpress"]}