What is the CVSS score of CVE-2025-31045?

CVE-2025-31045 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-31045?

The elfsight Contact Form widget (versions through 2.3.1) contains a vulnerability that could expose sensitive system information to unauthorized parties.

How to fix or mitigate CVE-2025-31045?

Within 24 hours: Inventory all instances of elfsight Contact Form widget across web properties and identify affected versions. Within 7 days: Implement network-level controls to restrict external access to widget endpoints and enable verbose logging on contact form submissions. Within 30 days: Contact elfsight for patch availability status; evaluate replacement solutions or request vendor security roadmap if patch timeline is extended.

Wordpress Plugin CVE-2025-31045

EUVD-2025-17491 HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2025-06-09 audit@patchstack.com

WordPress Information Disclosure Wordpress Plugin

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17491

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget allows Retrieve Embedded Sensitive Data. This issue affects elfsight Contact Form widget: from n/a through 2.3.1.

AnalysisAI

CVE-2025-31045 is an information disclosure vulnerability in the Elfsight Contact Form widget (versions through 2.3.1) that allows unauthenticated remote attackers to retrieve embedded sensitive data without any user interaction. The vulnerability exposes system information through an unauthorized control sphere, posing a high confidentiality risk with a CVSS score of 7.5. While the specific KEV status and EPSS probability are not provided in available sources, the network-accessible nature (AV:N) with no authentication required (PR:N) and lack of user interaction (UI:N) suggests this is readily exploitable by threat actors.

Technical ContextAI

The vulnerability stems from CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), which occurs when sensitive system-level information is inadvertently exposed to unauthorized entities or control domains. In the Elfsight Contact Form widget context, this likely involves improper access controls or data exposure mechanisms in the widget's backend API or embedded configuration data. The widget, commonly embedded in web pages via JavaScript, appears to expose sensitive embedded configuration, API keys, or system metadata that should be protected. The vulnerability affects the Elfsight Contact Form widget across versions up to and including 2.3.1, with no identified 'from' version specification suggesting all known versions may be vulnerable. This type of exposure is particularly dangerous in SaaS widget deployments where multiple customer environments share infrastructure.