The SimpleForm – Contact form made simple WordPress plugin suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin uses add_query_arg and remove_query_arg functions without appropriate escaping of URL parameters, enabling injection of malicious scripts. This affects all versions up to and including 2.2.0. An attacker can exploit this by crafting a URL that, when clicked by a user, executes arbitrary JavaScript in the context of the affected site. The vulnerability is identified as CWE-79 and has a CVSS v3.1 base score of 6.1 (medium severity).

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website, potentially leading to information disclosure or session hijacking. The vulnerability requires user interaction (clicking a malicious link) and does not grant direct access or denial of service. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking suspicious links related to the affected plugin and consider disabling or replacing the plugin if feasible. Monitor official SimpleForm or WordPress security advisories for updates.