CVE-2020-10385

🗓️ 11 Mar 2020 04:07:16Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 146 Views🌐 WEB

Stored XSS vulnerability in WPForms Contact Form plugin before 1.5.9

Reporter	Title	Published	Views	Family All 18
0day.today	Wordpress WPForms 1.5.9 Plugin - Persistent Cross-Site Scripting Vulnerability	24 Mar 202000:00	–	zdt
Circl	CVE-2020-10385	12 Dec 202302:13	–	circl
CNVD	WordPress WPForms Contact Form Plugin Cross-Site Scripting Vulnerability	25 Mar 202000:00	–	cnvd
Check Point Advisories	Wordpress WPForms Plugin Cross-Site Scripting (CVE-2020-10385)	31 Mar 202000:00	–	checkpoint_advisories
Cvelist	CVE-2020-10385	11 Mar 202004:07	–	cvelist
Exploit DB	WordPress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting	24 Mar 202000:00	–	exploitdb
EUVD	EUVD-2020-2838	7 Oct 202500:30	–	euvd
exploitpack	Wordpress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting	24 Mar 202000:00	–	exploitpack
NVD	CVE-2020-10385	24 Mar 202016:15	–	nvd
OpenVAS	WordPress WPForms Contact Form Plugin < 1.5.9 XSS Vulnerability	26 Mar 202000:00	–	openvas

NVD

Node

wpforms contact_formRange<1.5.9wordpress

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/156910/WordPress-WP-Forms-1.5.8.2-Cross-Site-Scripting.html
wpvulndb	www.wpvulndb.com/vulnerabilities/10114
getastra	www.getastra.com/blog/911/plugin-exploit/stored-xss-vulnerability-found-in-wpforms-plugin/
wordpress	www.wordpress.org/plugins/wpforms-lite/
jinsonvarghese	www.jinsonvarghese.com/stored-xss-vulnerability-found-in-wpforms-plugin/

Parameter	Position	Path	Description	CWE
fields[11][description]	request body	wp-admin/admin-ajax.php	Stored XSS in WPForms form description fields via admin-ajax call	CWE-79
settings[form_desc]	request body	wp-admin/admin-ajax.php	Stored XSS in WPForms form description fields via admin-ajax call	CWE-79

17 Jun 2026 02:47Current

5.1Medium risk

Vulners AI Score5.1

CVSS 23.5

CVSS 3.15.4

EPSS0.04428