CVE-2025-15028
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The FormGent – Next-Gen AI Form Builder for WordPress plugin is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
An attacker can inject malicious scripts that execute in the user's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
It is recommended to immediately update the FormGent plugin to a version newer than 1.9.2, which includes the fix. Also regularly review and sanitize form content.
Other vulnerabilities in FormGent
See all- CVE-2026-94499High
The FormGent plugin in versions up to and including 1.12.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. Missing access control checks allow unauthorized operations to be performed.
- CVE-2026-3141Critical
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on a REST API endpoint. Unauthenticated attackers can delete arbitrary files in the formgent uploads directory, and on Linux servers, if the directory does not exist, they can bypass path traversal protection and delete files like wp-config.php.
Original NVD description (English source)
The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS