Contact Form by Supsystic < 1.7.7 – Authenticated Stored Cross-Site Scripting (XSS) | Plugin Vulnerabilities

Description

The label field (Form name) was vulnerable to stored Cross-Site Scripting issue.

Proof of Concept

When creating or editing a form, use the following payload as a Form name (label field): "><script>alert(1)</script><!--', which will be executed when viewing the "Show All Forms" section, as well as when opening the Contact Details of a user having submitted to the affected form.

Affects Plugins

contact-form-by-supsystic

Fixed in 1.7.7

References

Exploitdb

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erik David Martin

Verified

Yes

WPVDB ID

a3146835-40f0-40ba-bde1-e2c0c9d0db97

Timeline

Publicly Published

2021-02-08 (about 5 years ago)

Added

2021-02-08 (about 5 years ago)

Last Updated

2021-02-09 (about 5 years ago)

Other

Published

Title

Published

2025-05-19

Title

bunny.net < 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-05-09

Title

GTmetrix for WordPress < 0.4.6 - Reflected Cross-Site Scripting

Published

2025-09-05

Title

Simple Text Slider <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2022-07-26

Title

Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting

Published

2024-04-30

Title

Sailthru Triggermail <= 1.1 - Reflected XSS