CVE-2025-47502: Mollie Forms Stored XSS Vulnerability

CVE-2025-47502 Overview

CVE-2025-47502 is a stored Cross-Site Scripting (XSS) vulnerability in the Mollie Forms WordPress plugin by Nick van Wobbie. The flaw affects all versions of mollie-forms up to and including 2.7.12. The issue stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An authenticated attacker with low privileges can inject malicious JavaScript that persists in the plugin's stored data. The payload executes in the browser of any user who later views the affected page, enabling session theft, credential harvesting, and administrative actions in the victim's context.

Critical Impact
Attackers with low-privilege access can inject persistent JavaScript that executes in administrator browsers, leading to account takeover and site compromise.

Affected Products

Mollie Forms plugin for WordPress (mollie-forms)
All versions from initial release through 2.7.12
WordPress sites running the vulnerable plugin with public form submission or authenticated user access

Discovery Timeline

2025-05-07 - CVE CVE-2025-47502 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47502

Vulnerability Analysis

The vulnerability resides in how the Mollie Forms plugin handles user-supplied input before rendering it back into web pages. The plugin fails to apply proper output encoding or input sanitization when storing form-related data. When an administrator or another user later views the injected content in the WordPress dashboard or on a rendered form, the browser interprets the payload as executable JavaScript.

Exploitation requires authentication with low privileges and a user interaction step to trigger the payload. The scope change reflected in the CVSS vector indicates the injected script executes outside the initially vulnerable component, reaching higher-privileged sessions. Successful exploitation compromises confidentiality, integrity, and availability of the affected WordPress instance.

Root Cause

The root cause is missing or insufficient output encoding of stored input fields handled by the plugin. Data submitted through the plugin's forms is written to the database and later rendered without HTML entity encoding or context-aware escaping. This violates the WordPress security guidance to sanitize on input and escape on output using functions such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

The attack is network-based and requires an attacker to hold a low-privilege authenticated account. The attacker submits a crafted payload containing JavaScript through a form field or an area processed by the plugin. The payload is persisted in the database. When a higher-privileged user, typically an administrator, views the entry through the WordPress admin interface, the script executes in their browser session. This enables cookie theft, forced administrative actions via CSRF-like flows, or the injection of additional persistent backdoors. Refer to the Patchstack Vulnerability Report for the disclosed technical context.

Detection Methods for CVE-2025-47502

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload= stored in Mollie Forms database tables
Administrator sessions showing anomalous outbound requests to unfamiliar domains shortly after viewing form submissions
Creation of new administrator accounts or plugin installations following access to the Mollie Forms admin pages

Detection Strategies

Query the WordPress database for form submission fields containing HTML tags or JavaScript event handlers
Review web server access logs for POST requests to Mollie Forms endpoints containing encoded script payloads
Enable a Content Security Policy in report-only mode to surface inline script execution in admin contexts

Monitoring Recommendations

Monitor WordPress audit logs for privilege escalation, user creation, and plugin or theme modifications
Alert on administrator sessions that trigger unusual DOM-based network activity when viewing plugin pages
Track plugin version inventory across managed WordPress sites and flag any instance running mollie-forms at or below 2.7.12

How to Mitigate CVE-2025-47502

Immediate Actions Required

Update the Mollie Forms plugin to a version above 2.7.12 as soon as the vendor publishes a fixed release
Audit existing form submissions and stored plugin data for injected scripts and remove malicious entries
Rotate credentials and session tokens for any administrator account that accessed form data before patching

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack lists all versions through 2.7.12 as vulnerable. Site owners should consult the Patchstack Vulnerability Report and the plugin's WordPress.org changelog for the fixed release version and apply it across all environments.

Workarounds

Restrict access to form submission endpoints using web application firewall rules that block HTML tags and JavaScript event handlers in payloads
Temporarily deactivate the Mollie Forms plugin on sites where patching cannot be completed immediately
Apply the principle of least privilege by limiting the number of low-privilege authenticated users who can submit form data

bash

# Example WordPress WP-CLI commands to inventory and disable the plugin
wp plugin list --name=mollie-forms --fields=name,status,version
wp plugin deactivate mollie-forms