FormGent CVE-2025-15028

Exploitation requires that the target WordPress site has the FormGent plugin installed and active in a version at or below 1.9.2, and that at least one form is publicly accessible for unauthenticated submission - the default use case for a contact/lead-generation form. No authentication is needed to plant the payload (PR:N per CVSS). Execution of the stored payload requires a victim - typically a WordPress user with dashboard access - to navigate to a page or admin view that renders the submitted form data. Sites where all FormGent forms are restricted to authenticated submitters reduce exposure significantly, as the attacker would then need valid credentials to inject. There are no platform, OS, or network topology prerequisites beyond a standard WordPress hosting environment.

The CVSS 7.2 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) presents a high aggregate score driven primarily by the absence of any authentication requirement, low attack complexity, and scope change into victim browser sessions. No EPSS data was provided; without it, exploitation probability cannot be quantitatively anchored, but unauthenticated stored XSS in a WordPress plugin historically sees rapid exploitation once public interest develops. KEV status is negative and no POC has been confirmed, suggesting no confirmed active exploitation at time of analysis. The UI:N designation in the vendor-provided vector reflects the attacker's perspective - the payload is stored without victim interaction - however, execution still requires a privileged user to visit the infected page, which slightly moderates immediate impact compared to a fully autonomous exploit. The real-world priority is moderate-to-high for sites running publicly accessible FormGent forms with untrusted submitters: a successful attack can hijack administrator sessions, install malicious plugins, or redirect visitors via DOM manipulation.

An unauthenticated attacker submits a FormGent form with a malicious JavaScript payload (e.g., a cookie-stealing script) embedded in a text field. The payload is stored in the WordPress database without sanitization. When a logged-in administrator next opens the form responses view in the WordPress dashboard, the script executes in the admin's browser, potentially exfiltrating session cookies or wp-nonce tokens and enabling full site takeover. No POC has been confirmed, but the attack requires no credentials and is trivially reproducible against any site with a publicly accessible FormGent form.