What is the CVSS score of CVE-2026-8172?

CVE-2026-8172 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Simple Basic Contact Form are affected by CVE-2026-8172?

The Simple Basic Contact Form WordPress plugin (all versions through 20250114) contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious code into website…

Is there a public PoC exploit available for CVE-2026-8172?

Yes, a public proof-of-concept exploit is available for CVE-2026-8172. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-8172?

Within 24 hours: disable the Simple Basic Contact Form plugin and identify an alternative contact form solution; review web server logs for exploitation attempts. Within 7 days: deploy a Web Application Firewall (WAF) rule to block XSS payloads in form parameters OR migrate to a patched alternative contact form plugin; implement Content Security Policy headers to restrict script execution. Within 30 days: monitor vendor advisories for security updates to version 20250115 or later; establish a controlled re-enablement plan once patch is released, or complete transition to a hardened replacement plugin.

Simple Basic Contact Form CVE-2026-8172

EUVD-2026-38418 HIGH

2026-06-23 WPScan

GHSA-x74w-29rh-ccvr

XSS WordPress Simple Basic Contact Form

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS reachable over the network without auth (PR:N) but requires victim click (UI:R); scope changes to browser, yielding limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 13:22 vuln.today

CVSS changed

Jun 23, 2026 - 13:22 NVD

7.1 (HIGH)

CVE Published

Jun 23, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 23, 2026 - 06:00 cve.org

HIGH 7.1

DescriptionCVE.org

The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.

Articles & Coverage 1

News 3 New WordPress Vulnerabilities - 3 High Severity, All With POC Jun 24, 2026

AnalysisAI

Reflected cross-site scripting in the Simple Basic Contact Form WordPress plugin (all versions through 20250114) allows unauthenticated remote attackers to execute arbitrary JavaScript in a visitor's browser when the victim follows a crafted link or submits a cross-site forged form that triggers a validation error. Publicly available exploit details have been published by WPScan, though the issue is not listed in CISA KEV and no EPSS data is provided in the input.

Technical ContextAI

The plugin renders user-supplied form input back into the page when validation fails, but fails to apply HTML/attribute escaping (e.g., esc_attr/esc_html) before reflection - a classic improper neutralization of input during web page generation (CWE-79). Affected component per CPE is cpe:2.3:a:unknown:simple_basic_contact_form, a WordPress plugin that exposes a public contact form, meaning the vulnerable code path is reachable on any front-end page where the form is embedded. Because WordPress executes the reflected payload in the context of the site origin, any active session cookies (including for logged-in administrators who happen to browse the page) and DOM data are exposed.

RemediationAI

No vendor-released patched version is identified in the supplied data - the WPScan advisory lists the plugin as vulnerable through 20250114 with no fixed release cited, so treat this as 'No vendor-released patch identified at time of analysis' and monitor https://wpscan.com/vulnerability/535ec1a1-b822-43c9-8264-6442199493d3/ for a fixed build. In the interim, deactivate and remove the Simple Basic Contact Form plugin (side effect: loss of contact form functionality - replace with a maintained alternative such as Contact Form 7 or WPForms) or place a WAF/ModSecurity rule in front of the form endpoint to block reflected payloads containing script tags, event handlers, and javascript: URIs (side effect: possible false positives on legitimate submissions containing angle brackets). Hardening WordPress with a strict Content-Security-Policy that disallows inline scripts will reduce, though not eliminate, exploitability.