CVE-2025-32199: vcita Contact Form Builder XSS Vulnerability

CVE-2025-32199 Overview

CVE-2025-32199 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Contact Form Builder by vcita WordPress plugin (contact-form-with-a-meeting-scheduler-by-vcita). The flaw affects all plugin versions up to and including 4.10.2. The issue stems from improper neutralization of user-controllable input during web page generation, classified as [CWE-79]. Authenticated attackers with low privileges can inject malicious scripts that execute in the browsers of users who interact with crafted content. Because the payload executes in the client-side Document Object Model (DOM), server-side filters may not observe or block it.

Critical Impact
Successful exploitation allows script execution in a victim's browser session, enabling session theft, unauthorized actions, or delivery of secondary payloads against WordPress users.

Affected Products

Contact Form Builder by vcita (WordPress plugin slug: contact-form-with-a-meeting-scheduler-by-vcita)
All plugin versions from n/a through 4.10.2
WordPress sites running the vulnerable plugin with authenticated user access

Discovery Timeline

2025-04-10 - CVE-2025-32199 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32199

Vulnerability Analysis

The vulnerability is a DOM-based XSS flaw within the Contact Form Builder by vcita plugin. Unlike reflected or stored XSS, DOM-based XSS occurs entirely within client-side JavaScript. The plugin passes attacker-controlled input into a DOM sink without adequate sanitization or output encoding. When a browser renders the affected page, the injected payload runs in the context of the WordPress site's origin.

Exploitation requires low-privileged authentication and user interaction, and the scope is changed. That means an attacker with a basic account can trigger script execution that affects other users, including higher-privileged accounts such as editors or administrators who view the manipulated content.

Root Cause

The root cause is improper neutralization of input during web page generation. Client-side code in the plugin reads attacker-controlled values and writes them into the DOM using unsafe constructs such as innerHTML, document.write, or similar sinks. Because sanitization is missing or incomplete, JavaScript embedded in the input is parsed and executed by the browser.

Attack Vector

The attack vector is network-based and requires authenticated access with low privileges and user interaction. An attacker submits crafted input through a plugin feature that later gets rendered client-side. When a victim loads the resulting page, the browser evaluates the attacker's script in the vulnerable site's origin. See the Patchstack Vulnerability Advisory for advisory details.

No public proof-of-concept code has been verified for CVE-2025-32199. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2025-32199

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload) stored in WordPress database tables tied to the plugin.
Outbound browser requests from authenticated sessions to unknown external domains shortly after loading plugin-rendered pages.
Newly created WordPress administrator accounts or unauthorized changes to user roles following interaction with contact form content.

Detection Strategies

Inventory WordPress installations and identify sites running contact-form-with-a-meeting-scheduler-by-vcita at version 4.10.2 or earlier.
Deploy Content Security Policy (CSP) reporting to surface inline script execution or script loads from unapproved origins.
Review web server access logs for POST requests to plugin endpoints containing HTML tags, encoded angle brackets, or JavaScript keywords.

Monitoring Recommendations

Monitor WordPress audit logs for anomalous form submissions and administrative actions performed by low-privileged accounts.
Alert on modifications to plugin data records that contain HTML or script markup where plain text is expected.
Track browser-side errors and CSP violations reported by users interacting with contact form pages.

How to Mitigate CVE-2025-32199

Immediate Actions Required

Update the Contact Form Builder by vcita plugin to a version later than 4.10.2 once the vendor publishes a fixed release.
Restrict WordPress account provisioning and enforce least-privilege roles to reduce the pool of accounts that can exploit the flaw.
Force password resets and invalidate active sessions for administrative users on sites where exploitation is suspected.

Patch Information

Consult the Patchstack Vulnerability Advisory for the current patch status and vendor guidance. If no fixed version is available, treat the plugin as vulnerable and prioritize compensating controls.

Workarounds

Deactivate and remove the Contact Form Builder by vcita plugin until a patched release is available.
Deploy a web application firewall (WAF) rule that blocks HTML and JavaScript tokens in requests targeting plugin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate contact-form-with-a-meeting-scheduler-by-vcita
wp plugin delete contact-form-with-a-meeting-scheduler-by-vcita