What is the CVSS score of CVE-2025-15028?

CVE-2025-15028 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of FormGent are affected by CVE-2025-15028?

FormGent WordPress plugin (versions ≤1.9.2) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject persistent malicious scripts into form fields that…

How to fix or mitigate CVE-2025-15028?

Within 24 hours: Disable and remove FormGent plugin (versions 1.9.2 and earlier) from all WordPress installations; audit the database for suspicious form submissions containing script payloads. Within 7 days: Purge identified malicious content from form submission storage; review access and administration logs for exploitation evidence; deploy Web Application Firewall (WAF) rules to block form submissions containing script tags as interim containment. Within 30 days: Migrate to an actively maintained alternative form plugin (WPForms, Gravity Forms, or equivalent with current security patches) or implement a custom form solution with input sanitization and output escaping; conduct security verification of the replacement before public re-enablement.

FormGent CVE-2025-15028

EUVD-2025-210640 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Wordfence

GHSA-q93x-h976-c39h

WordPress XSS Wordpress Plugin Formgent Next Gen Ai Form Builder For Wordpress With Multi Step Quizzes Payments More Wpwax

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

UI:R chosen over vendor UI:N because stored XSS payload execution requires a victim to load the affected page, which is a required user action distinct from the attacker's submission step.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 12:22 vuln.today

CVE Published

Aug 06, 2026 - 11:29 nvd

HIGH 7.2

DescriptionCVE.org

The FormGent - Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause: user-supplied data from form submission fields is neither sanitized on ingestion nor properly escaped on output, allowing raw HTML and JavaScript to be stored in the WordPress database and later rendered verbatim in page content. The affected product is the wpwax FormGent plugin for WordPress (CPE: cpe:2.3:a:wpwax:formgent_-_next-gen_ai_form_builder_for_wordpress_with_multi-step,_quizzes,_payments_&_more:*:*:*:*:*:*:*:*), a multi-step form builder that supports AI-generated forms, quizzes, and payments - all surface areas that may expose form submission endpoints to unauthenticated users. The stored (persistent) nature of the XSS means the payload survives across sessions and executes for every subsequent visitor to the affected page, multiplying impact relative to reflected XSS. The CVSS S:C (scope changed) metric confirms the exploit crosses from the plugin's trust boundary into the victim's authenticated browser context.

RemediationAI

The upstream fix has been committed to the WordPress plugin repository as changeset 3604540 (https://plugins.trac.wordpress.org/changeset/3604540/formgent); the exact released version number containing this patch was not independently confirmed from the provided data, so administrators should update FormGent to the latest available version via the WordPress plugin dashboard and verify it exceeds 1.9.2. If an immediate upgrade is not possible, a targeted compensating control is to restrict access to form submission endpoints to authenticated users only, which removes the unauthenticated attack vector - though this trade-off may impact legitimate public-facing form functionality. Alternatively, a web application firewall (WAF) rule blocking script injection patterns in POST body parameters to FormGent endpoints can reduce risk without changing plugin behavior, at the cost of potential false positives on legitimate rich-text submissions. The Wordfence advisory at the reference URL should be consulted for any additional vendor-recommended mitigations.