Stored Cross-Site Scripting Vulnerability in Contact Form by Supsystic for WordPress

CVE-2026-83625

What is CVE-2026-83625?

The Contact Form by Supsystic plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. An unauthenticated attacker can exploit this vulnerability by manipulating IP headers to inject malicious scripts into web pages. This allows the attacker to execute arbitrary scripts when users access compromised pages. The attack can begin with the unauthenticated initiation of the 'updateNonce' action, which lacks proper authentication controls, enabling the attacker to gain a valid nonce. By submitting a manipulated contact form, attackers can insert harmful payloads, exposing users to security threats.

References