CVE-2025-9562

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9562", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-27T21:14:05.609Z", "datePublished": "2025-10-18T06:42:46.555Z", "dateUpdated": "2026-04-08T16:55:08.978Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:08.978Z"}, "affected": [{"vendor": "themeisle", "product": "Redirection for Contact Form 7", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a801bb0-a7fc-42c3-b26f-3f7cdb592bea?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.5/wpcf7r-functions.php#L558"}, {"url": "https://wordpress.org/plugins/wpcf7-redirect/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378810%40wpcf7-redirect&new=3378810%40wpcf7-redirect&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-09-26T20:26:17.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-17T17:48:32.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T18:34:21.658144Z", "id": "CVE-2025-9562", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T16:13:26.280Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9562", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T18:34:21.658144Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T16:13:21.630Z"}}], "cna": {"title": "Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "themeisle", "product": "Redirection for Contact Form 7", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.2.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-26T20:26:17.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-17T17:48:32.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a801bb0-a7fc-42c3-b26f-3f7cdb592bea?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.5/wpcf7r-functions.php#L558"}, {"url": "https://wordpress.org/plugins/wpcf7-redirect/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378810%40wpcf7-redirect&new=3378810%40wpcf7-redirect&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-18T06:42:46.555Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9562", "state": "PUBLISHED", "dateUpdated": "2025-10-27T16:13:26.280Z", "dateReserved": "2025-08-27T21:14:05.609Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-18T06:42:46.555Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Redirection for Contact Form 7", "vendor": "themeisle", "versions": [{"lessThanOrEqual": "3.2.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Redirection for Contact Form 7 para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode qs_date del plugin en todas las versiones hasta la 3.2.6, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-9562", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9562", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T18:34:21.658144Z", "version": "2.0.3"}}]}, "published": "2025-10-18T07:15:36.213", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.5/wpcf7r-functions.php#L558"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378810%40wpcf7-redirect&new=3378810%40wpcf7-redirect&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wpcf7-redirect/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a801bb0-a7fc-42c3-b26f-3f7cdb592bea?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:14:11.465552+00:00", "value": {"mitigation_remediation": ["Upgrade Redirection for Contact Form\u00a07 to the latest released version that addresses the qs_date XSS issue", "Remove or disable any qs_date shortcode usage from all posts and templates until an update is applied", "If an upgrade is not immediately possible, restrict contributor access and use role\u2011based filters to prevent the shortcode from being inserted by untrusted users"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting leading to arbitrary script execution via the plugin\u2019s shortcode"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the Redirection for Contact Form\u00a07 plugin from themeisle, versions 3.2.6 and earlier. The plugin is widely used to redirect after form submission, so any site running these versions is at risk.", "description_and_impact": "The Redirection for Contact Form\u00a07 plugin contains insufficient input sanitization on the qs_date shortcode, allowing an authenticated user with contributor or higher privileges to inject arbitrary JavaScript into stored post content. Once injected, the script runs automatically whenever any user visits the affected page, potentially leading to theft of credentials, defacement, or full compromise of the victim\u2019s browser context. The weakness is a classic stored cross\u2011site scripting flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1\u202f% suggests a low exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw requires only contributor\u2011level authentication\u2014a role common in many sites\u2014and the payload is stored in the database, a successful exploit can affect all site visitors. Attackers would typically create or edit a post that contains the malicious qs_date shortcode, ensuring the payload persists until removed."}}}}, "created": "2025-10-20T13:21:37.743690+00:00", "updated": "2026-04-21T02:15:06.533072+00:00", "vendors": ["themeisle", "themeisle$PRODUCT$redirection_for_contact_form_7", "wordpress", "wordpress$PRODUCT$wordpress"]}