Technical impact
The Contact Form by Supsystic plugin does not sanitise or escape the form name field before rendering it on a page. Users with access to the form editor can inject arbitrary JavaScript, which executes when another user views the form. On multisite installations, administrators may lack the unfiltered_html capability, so the injected script can execute under a higher privilege level than the attacker normally holds, potentially allowing session hijacking, data theft, or defacement. Affected systems include the WordPress plugin Contact Form by Supsystic versions prior to 1.8.0. No more specific version numbers are disclosed, but any release below 1.8.0 is considered vulnerable. The vulnerability’s CVSS score is 3.5, and the EPSS score is < 1%. Because exploitation requires authenticated access to the form editor, the likelihood is limited to users with that capability, but the impact is severe if an elevated‑privilege attacker succeeds. The vulnerability is not listed in CISA’s KEV catalog.
Affected Systems
The plug‑in "Contact Form by Supsystic" for WordPress is affected in all releases earlier than version 1.8.0. Any WordPress installation that has the plugin installed and running a vulnerable version falls under the scope of this vulnerability.
Risk and Exploitability
The exploit requires an authenticated user who has privileges to edit the form editor. Attackers can inject malicious JavaScript into the form name field, which is then rendered on any page displaying the form and executed in the victim’s browser. In WordPress multisite environments where the administrator role does not possess unfiltered_html, the injected code runs with higher privileges than the attacker, allowing potential session hijacking, theft of administrative secrets, or site defacement. The CVSS score is 3.5 and the EPSS score is < 1%; the vulnerability is not cataloged in the CISA KEV list. Therefore, the risk is contingent on the attacker having form‑editor access and the presence of a multisite configuration that elevates privilege. The overall potential impact is severe if an attacker succeeds in compromising a privileged user session.
