The Simple Basic Contact Form WordPress plugin up to version 20250114 contains a reflected XSS vulnerability (CWE-79). Specifically, user input is not properly escaped before being reflected in the contact form output during validation error handling. This flaw enables unauthenticated attackers to inject malicious scripts via crafted URLs or form submissions, potentially impacting site visitors who follow these links or submit forms. No CVSS score or detailed vendor advisory is available, and no patch or remediation information has been provided.

This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of site visitors by tricking them into clicking crafted links or submitting malicious forms. This can lead to session hijacking, defacement, or other client-side attacks against users of affected websites. The vulnerability affects the confidentiality and integrity of user interactions with the affected site but does not directly compromise the server or site backend.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider disabling or replacing the Simple Basic Contact Form plugin to prevent exploitation. Implementing web application firewall (WAF) rules to detect and block reflected XSS payloads may provide temporary protection.