WordPress Plugin Vulnerabilities
Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
Description
The plugin does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
Proof of Concept
Affects Plugins
Fixed in 1.8.0 References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Hanif Naufal Rahman
Submitter
kalibuntu
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-23 (about 2 days ago)
Added
2026-10-23 (about 1 day ago)
Last Updated
2026-10-23 (about 1 day ago)
