Simple Basic Contact Form CVE-2026-8172

Exploitation requires (1) the target WordPress site to have the Simple Basic Contact Form plugin installed and active at version ≤20250114, (2) the vulnerable contact form to be reachable on a public page so the validation-error code path can be triggered, and (3) a victim with a browser to either click an attacker-crafted link or submit a cross-site forged POST (UI:R), since reflected XSS does not fire without victim interaction. No authentication is required on the attacker side (PR:N), but the impact scales with the victim's privileges - exploitation against a logged-in administrator yields full session compromise, while exploitation against anonymous visitors is limited to client-side actions in their browser.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) is consistent with a reflected XSS: network reachable, no privileges, but user interaction required, with scope change reflecting browser-side impact. Publicly available exploit code exists (WPScan write-up), which materially raises opportunistic risk, but the vulnerability is not in CISA KEV and no EPSS score is provided, so there is no current evidence of mass exploitation. Realistic priority is moderate - high enough to patch promptly on any site running the plugin (especially those with authenticated admins), but the UI:R requirement and need for a tailored lure prevent it from being a wormable, fully automatable threat.

An attacker crafts a URL or an external HTML form that submits to the plugin's contact form endpoint with invalid input plus a JavaScript payload in one of the reflected fields, then lures a victim (e.g., a site administrator) to click the link via phishing or a malicious comment. The validation-error page reflects the payload unescaped, executing the attacker's JavaScript under the site's origin and enabling session theft, admin action forgery, or drive-by redirection; a public WPScan PoC documents the exact parameter and payload format.