CVE-2026-83625: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in supsysticcom Contact Form by Supsystic

CVE-2026-83625 describes a stored cross-site scripting vulnerability in the Contact Form by Supsystic WordPress plugin affecting all versions up to and including 1.10.2. The flaw arises from improper sanitization and escaping of IP address headers, enabling unauthenticated attackers to inject malicious scripts. Attackers can first call the 'updateNonce' action, which lacks authentication controls, to obtain a valid nonce, then submit a contact form with a crafted payload in spoofed headers like X-Forwarded-For. This results in persistent script injection that executes in the context of users viewing the affected pages.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect availability and requires no user interaction beyond visiting the injected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the 'updateNonce' action if possible and monitor for suspicious activity related to contact form submissions with spoofed IP headers.