The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users…
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 07:51:06 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
AI-suggested
Upgrade the Contact Form by Supsystic WordPress plugin to version 1.8.0 or later where this issue is fixed. If upgrading is not immediately possible, restrict form editor access to trusted users only to reduce risk.
Description
The Contact Form by Supsystic WordPress plugin versions before 1.8.0 do not properly sanitize and escape form names. This vulnerability allows users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite WordPress installations, this can lead to privilege escalation where administrators without the unfiltered_html capability are affected.
Impact
Users with form editor access can inject malicious scripts that execute in the browsers of other users viewing the form, potentially leading to session hijacking, defacement, or other script-based attacks. On multisite installations, this vulnerability allows privilege escalation affecting administrators without unfiltered_html rights, increasing the potential impact.