CVE-2026-83625: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in supsysticcom Contact Form by Supsystic

CVE-2026-83625 describes a stored cross-site scripting vulnerability in the Contact Form by Supsystic WordPress plugin affecting all versions up to and including 1.10.2. The flaw arises from improper neutralization of input during web page generation, specifically via the IP address header (e.g., X-Forwarded-For). An attacker can bypass authentication by calling an unauthenticated 'updateNonce' action to obtain a valid nonce, then submit a contact form with a malicious script payload in a spoofed IP header. This script is stored and executed in the context of users viewing the injected page, leading to potential information disclosure or session hijacking. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity with no availability impact. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation allows unauthenticated attackers to inject and store malicious scripts that execute in the browsers of users accessing the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim user. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires no privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin or its affected functionality. Monitoring for suspicious activity related to the 'updateNonce' action and input validation on IP headers may help reduce risk. Avoid exposing the plugin to untrusted users if possible.