EUVD-2026-71934
GHSA-47p6-99pv-q7v3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCall unauthenticated updateNonce AJAX action
-
DeliveryReceive valid WordPress nonce
-
ExploitSubmit contact form with malicious X-Forwarded-For header
-
ExecutionPlugin stores unsanitized IP value in database
-
PersistAdmin views contacts list in dashboard
-
ImpactStored script executes in admin browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Three concrete conditions must hold: (1) The target site must have the Contact Form by Supsystic plugin installed and active in version 1.10.2 or earlier; (2) At least one contact form must exist and be reachable for submission - no special form configuration is required beyond basic installation; (3) A victim with access to the admin contacts list (typically a WordPress Administrator or Editor with plugin access) must navigate to the contacts view after injection. The critical enabler is the |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N yields 7.2 (High), but the UI:N designation is debatable: stored XSS requires a victim (typically a site administrator) to navigate to the contacts list page for the payload to execute, which is more accurately coded as UI:R, dropping the score to approximately 6.1 (Medium). That said, stored XSS targeting admin sessions carries meaningful real-world risk - a successful hit against a logged-in admin can lead to credential theft, malicious admin account creation, or plugin/theme installation. EPSS data is not provided; no KEV listing and no public exploit are identified, so automated mass exploitation is not currently occurring. The primary risk is opportunistic: attackers submitting forms to WordPress sites running this plugin at scale and waiting for an admin to view contacts, which is a well-understood and easily automated pattern. |
| Exploit ScenarioDerived | An attacker scripted to harvest WordPress sites running Contact Form by Supsystic sends an unauthenticated POST to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's updateNonce action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted X-Forwarded-For value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
RemediationAI
Update the Contact Form by Supsystic plugin to the version corresponding to WordPress.org changeset 3679442, which contains the fix commit (https://plugins.trac.wordpress.org/changeset?reponame=&old=3679442%40contact-form-by-supsystic&new=3679442%40contact-form-by-supsystic). A specific released version number beyond 1.10.2 is not independently confirmed from the available data - verify the current version in the WordPress plugin repository before applying. If an immediate update is not possible, compensating controls include: (1) restricting access to the admin-ajax.php endpoint for the updateNonce action via WAF rule targeting action=updateNonce with unauthenticated requests - trade-off: may disrupt legitimate nonce refresh flows; (2) blocking or stripping X-Forwarded-For, X-Real-IP, and similar proxy headers at the reverse proxy or WAF layer before they reach WordPress - trade-off: breaks real IP logging for all plugins; (3) limiting form submission rates per IP at the WAF to reduce at-scale injection attempts. The Wordfence advisory should be monitored for a confirmed patched release version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin fails at two distinct points. First, controller.php registers the updateNonce AJAX action without adding it to the permission-checked list, so WordPress treats it as publicly callable (logged-out context). Second, utils.php reads the X-Forwarded-For (or similar proxy) header to capture submitter IP and stores it via forms.php without sanitization. The raw value is later rendered in the admin contacts list (admin.forms.contacts.list.js) without output escaping, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). Because XSS crosses the boundary from the plugin execution context into the authenticated admin browser session, the CVSS scores this S:C (scope change). CPE: cpe:2.3:a:supsysticcom:contact_form_by_supsystic:*:*:*:*:*:*:*:* covering all versions through 1.10.2.
Know when Contact Form By Supsystic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires an admin victim to view the contacts page (UI:R); all other metrics from the provided vector are accurate.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action - which is accessible without authentication due to its absence from the plugin's permission list - to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.
Executive ViewAI
Contact Form by Supsystic WordPress plugin (versions ≤1.10.2) contains a stored cross-site scripting flaw exploitable by unauthenticated attackers to inject persistent scripts into administrator sessions. While no public exploit code exists at this time, the vulnerability is publicly documented with direct code references, exposing any WordPress site using this plugin to credential theft, account compromise, and website defacement.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately disable and uninstall the vulnerable plugin; (2) Implement a Web Application Firewall rule to sanitize X-Forwarded-For headers; (3) Restrict WordPress admin panel access to specific trusted IP ranges; (4) Deploy Content Security Policy (CSP) headers with script-src restrictions to prevent inline script execution; (5) Audit and sanitize all stored contact form submissions; (6) Enable WordPress security logging and monitor for suspicious admin login patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Contact Form By Supsystic
View allRemote code execution in Contact Form by Supsystic plugin for WordPress (all versions ≤1.7.36) allows unauthenticated at
Stored server-side template injection in the WordPress plugin Contact Form by Supsystic before 1.11.1 lets a WordPress a
Cross-site request forgery in the Supsystic Contact Form plugin for WordPress before 1.11.1 lets an attacker overwrite a
Unauthenticated deletion of stored form statistics is possible in the Contact Form by Supsystic WordPress plugin before
Cross-site request forgery in the WordPress plugin Contact Form by Supsystic before 1.11.1 lets an attacker permanently
Email header injection in the Supsystic Contact Form plugin for WordPress (versions before 1.11.1) lets unauthenticated
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin before 1.8.0 lets users with access to the
Unauthenticated information disclosure in the Supsystic Contact Form WordPress plugin (all versions through 1.10.5) lets
Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a
Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes
Missing authorization (CWE-862) in the WordPress plugin Contact Form by Supsystic, affecting all versions through 1.10.7
Exploit-DB