Reflected Cross-Site Scripting in Simple Basic Contact Form Plugin for WordPress
CVE-2026-8172
Currently unrated
What is CVE-2026-8172?
The Simple Basic Contact Form plugin for WordPress, up to version 20250114, is susceptible to a reflected Cross-Site Scripting (XSS) vulnerability. This issue arises from inadequate escaping of user-supplied input, which can be exploited by unauthenticated attackers. By crafting malicious links or manipulating cross-site form submissions, attackers can inject harmful scripts that will be executed in the browsers of unsuspecting site visitors, compromising user data and website integrity.
Affected Version(s)
Simple Basic Contact Form 0 <= 20250114
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.