The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users…
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 07:51:06 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
AI-suggested
Upgrade the Contact Form by Supsystic WordPress plugin to version 1.8.0 or later where this issue is fixed. If upgrading is not immediately possible, restrict form editor access to trusted users only to reduce risk.
Description
A Cross-Site Scripting (XSS) vulnerability exists in the Contact Form by Supsystic WordPress plugin versions before 1.8.0. The plugin fails to properly sanitize and escape the form name, allowing users with form editor access to inject arbitrary scripts. On multisite WordPress installations, this vulnerability can be exploited to cross privilege boundaries when administrators lack the unfiltered_html capability.
Impact
Users with form editor access can inject malicious scripts that execute in the browsers of other users viewing the form, potentially leading to session hijacking, defacement, or other script-based attacks. On multisite installations, this vulnerability allows privilege escalation affecting administrators without unfiltered_html rights, increasing the potential impact.
Summary
The Contact Form by Supsystic WordPress plugin prior to version 1.8.0 contains a vulnerability where form names are not sanitized or escaped. This flaw enables users who can edit forms to inject arbitrary scripts, resulting in cross-site scripting (XSS) attacks that execute in the context of other users viewing the form. In multisite environments, this vulnerability crosses privilege boundaries by affecting administrators who lack the unfiltered_html capability.