A flaw in the Contact Form by Supsystic plugin allows an unauthenticated attacker to inject arbitrary script code through the form’s input fields. The injected code is reflected in the page response without proper output encoding, leading to a classic reflected XSS scenario. An attacker can use this to execute malicious scripts in the browser context of any user who views the affected form, potentially capturing session tokens, defacing the site, or redirecting victims to phishing pages.

The vulnerability exists in all versions of the WordPress Contact Form by Supsystic plugin released before 1.10.0. WordPress sites that have the plugin installed without a recent update are at risk.

The CVSS score of 7.1 indicates a high severity due to the lack of authentication required and the availability of the site to the public web. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Attackers most likely exploit the issue by submitting malicious content through the publicly accessible contact form, which then returns the unsanitized payload to the browser.