CVE-2025-58665: Form Generator WordPress Plugin XSS Flaw

CVE-2025-58665 Overview

CVE-2025-58665 is a stored Cross-Site Scripting (XSS) vulnerability in the Form Generator for WordPress plugin (form-generator-powered-by-jotform) developed by tmontg1. The flaw affects all plugin versions up to and including 1.52. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with high privileges to inject persistent JavaScript payloads. Successful exploitation requires user interaction and can affect resources beyond the vulnerable component due to a scope change [CWE-79].

Critical Impact

An authenticated attacker can inject persistent script payloads that execute in the browser context of site visitors, enabling session theft, redirection, or defacement.

Affected Products

• Form Generator for WordPress plugin (form-generator-powered-by-jotform)
• All versions from n/a through 1.52
• WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

• 2025-09-22 - CVE-2025-58665 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58665

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw categorized under [CWE-79]. The plugin accepts input from privileged users and stores it without proper sanitization or output encoding. When the stored content is rendered in a web page, the browser interprets the injected payload as executable JavaScript.

Because the vulnerability produces a scope change, the injected script can affect components outside the plugin's original security boundary. This includes the broader WordPress administrative interface and content viewed by site visitors. The attack vector is network-based and requires user interaction to trigger the payload.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin does not apply WordPress sanitization helpers such as wp_kses, esc_html, or esc_attr on user-supplied form configuration data before persisting it or rendering it back to the DOM.

Attack Vector

An attacker with high-privilege access, such as an administrator or editor role, submits a crafted payload through the plugin's form configuration interface. The payload persists in the WordPress database. When another user loads a page containing the malicious form data, the browser executes the injected script under the site's origin. See the Patchstack WordPress XSS Vulnerability advisory for technical details.

Detection Methods for CVE-2025-58665

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handler attributes stored within form configuration records in the WordPress database.
• Outbound HTTP requests from visitor browsers to attacker-controlled domains after loading pages that render Form Generator content.
• Unauthorized administrative account creation or session cookie exfiltration events correlated with plugin activity.

Detection Strategies

• Query the wp_posts and wp_postmeta tables for form entries containing HTML script tags, onerror, onload, or encoded payload markers.
• Review web server access logs for administrative POST requests to plugin endpoints followed by anomalous GET requests referencing script payloads.
• Deploy a web application firewall rule to flag inbound requests containing script content targeting plugin form configuration endpoints.

Monitoring Recommendations

• Enable WordPress audit logging to capture changes made by administrative accounts to plugin configuration data.
• Monitor browser Content Security Policy (CSP) violation reports for inline script executions originating from pages that embed forms.
• Alert on privilege escalation events, new administrator accounts, and unexpected changes to wp_users following plugin activity.

How to Mitigate CVE-2025-58665

Immediate Actions Required

• Deactivate the Form Generator for WordPress plugin until a patched release is verified and installed.
• Audit all existing form entries and configuration data for script payloads and remove any malicious content.
• Rotate WordPress administrator credentials and invalidate active sessions to contain potential post-exploitation activity.

Patch Information

At the time of publication, no fixed version is listed in the advisory. The vulnerability affects all versions through 1.52. Monitor the Patchstack advisory and the WordPress plugin repository for a release addressing this issue.

Workarounds

• Restrict administrative and editor role assignments to trusted users only, since exploitation requires high-privilege access.
• Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Place the WordPress admin interface behind an application-layer firewall configured to block XSS payloads in POST bodies.

# Configuration example: enforce a restrictive CSP via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"