What is the CVSS score of CVE-2025-52753?

CVE-2025-52753 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-52753?

The Contact Form by Supsystic WordPress plugin (versions ≤1.7.36) contains a reflected XSS vulnerability that allows attackers to inject malicious scripts through crafted URLs, potentially…

How to fix or mitigate CVE-2025-52753?

Within 24 hours: Audit deployed WordPress instances for Contact Form by Supsystic plugin presence and document all affected versions. Within 7 days: Contact the plugin vendor for updated release timelines; implement Web Application Firewall (WAF) rules to filter XSS payloads in URL parameters targeting contact form endpoints; disable the plugin if no patched version is available and no alternative is critical to operations. Within 30 days: Migrate to an alternative contact form solution with active security maintenance or deploy the patched version immediately upon vendor release.

PHP CVE-2025-52753

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress PHP XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Reflected XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.36.

AnalysisAI

Reflected cross-site scripting (XSS) in the Contact Form by Supsystic WordPress plugin (versions through 1.7.36) allows unauthenticated remote attackers to execute malicious JavaScript in victims' browsers via crafted URLs. The vulnerability enables session hijacking, credential theft, and malicious actions performed in the context of the victim's authenticated session. EPSS probability indicates low exploitation likelihood (0.07%, 22nd percentile) with no public exploit identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation). The Contact Form by Supsystic WordPress plugin fails to properly sanitize user-controllable input before reflecting it in HTML responses. In WordPress plugins, reflected XSS typically occurs when query parameters, form submissions, or URL path segments are echoed into page output without encoding special characters like angle brackets, quotes, or script tags. The CVSS vector indicates network-based delivery (AV:N) with low attack complexity (AC:L), meaning exploitation requires only basic web request manipulation. The changed scope (S:C) indicates the vulnerability can affect resources beyond the vulnerable component itself, consistent with browser-based XSS attacks that can interact with other same-origin resources or leverage the victim's authenticated WordPress session.

Affected ProductsAI

The vulnerability affects the Contact Form by Supsystic WordPress plugin in all versions from the initial release through version 1.7.36 inclusive. This is a third-party WordPress plugin developed by Supsystic and distributed through the official WordPress.org plugin repository. Organizations running WordPress installations with this plugin installed at version 1.7.36 or earlier are vulnerable to reflected XSS attacks. The Patchstack vulnerability database provides detailed tracking and vendor advisory information at the reference URL provided.

RemediationAI

WordPress administrators should immediately upgrade the Contact Form by Supsystic plugin to version 1.7.37 or later, which addresses the reflected XSS vulnerability according to the Patchstack advisory. Access the WordPress admin dashboard, navigate to Plugins, locate Contact Form by Supsystic, and click Update. Alternatively, administrators can deactivate and remove the plugin if contact form functionality is not required or can be replaced with alternative solutions. As a temporary mitigation measure until patching, implement Web Application Firewall (WAF) rules to filter suspicious query parameters and apply Content Security Policy (CSP) headers to restrict inline JavaScript execution, though these workarounds provide incomplete protection. Consult the full vendor advisory at https://patchstack.com/database/Wordpress/Plugin/contact-form-by-supsystic/vulnerability/wordpress-contact-form-by-supsystic-plugin-1-7-35-cross-site-scripting-xss-vulnerability for additional context and remediation guidance.