CVE-2025-2801

Summary

CVE-2025-2801 is a vulnerability affecting the "Create custom forms for WordPress with a smart form plugin for smart businesses" plugin up to version 1.2.4. This issue allows unauthenticated attackers to execute arbitrary shortcodes due to insufficient validation of user input before processing with the do_shortcode function. This vulnerability poses a significant risk as it enables attackers to inject malicious code into a WordPress website, potentially leading to data theft or website defacement. Users are strongly advised to update to the latest version of the plugin to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.