CVE-2025-26560
Published: 26 March 2025
Summary
CVE-2025-26560 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-26560 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the KKWangen WP Contact Form III plugin (wp-contact-form-iii) for WordPress. This issue affects all versions of the plugin from n/a through 1.6.2d inclusive. Published on 2025-03-26, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.
A remote, unauthenticated attacker can exploit this vulnerability by crafting a malicious URL containing an XSS payload and tricking a victim user—such as a site visitor or administrator—into accessing it, for example via phishing or social engineering. User interaction is required, but once triggered, the payload executes in the victim's browser in the context of the vulnerable WordPress site, enabling potential theft of session tokens, cookies, or other sensitive data, as well as actions performed on the victim's behalf, with low impacts to confidentiality, integrity, and availability across the changed scope.
The primary advisory reference is available from Patchstack at https://patchstack.com/database/Wordpress/Plugin/wp-contact-form-iii/vulnerability/wordpress-wp-contact-form-iii-plugin-1-6-2d-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which details the vulnerability in the WP Contact Form III plugin up to version 1.6.2d. Security practitioners should review this source for recommended mitigations, such as plugin updates if patches are issued or temporary workarounds like input sanitization.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8171
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KKWangen WP Contact Form III wp-contact-form-iii allows Reflected XSS.This issue affects WP Contact Form III: from n/a through <= 1.6.2d.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of public-facing applications (T1190) to execute attacker-controlled JavaScript in the victim's browser (T1059.007) via malicious URL.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of inputs to prevent improper neutralization of malicious scripts in reflected XSS attacks.
SI-15 mandates output filtering and encoding to block execution of reflected XSS payloads in generated web pages.
SI-2 ensures timely flaw remediation by patching the vulnerable WP Contact Form III plugin versions.