The Simple Basic Contact Form WordPress plugin up through 20250114 fails to escape user‑supplied content that is reflected back to the browser during form validation failures. When an attacker submits a crafted value, the plugin outputs that value unchanged, allowing arbitrary scripts to execute in the context of any visitor who loads the error page or form. This vulnerability enables cross‑site scripting that can hijack sessions, steal credentials, or deface the site, depending on the attacker’s goal.

WordPress sites that install the Simple Basic Contact Form plugin version 20250114 or earlier are affected. Any consumer of that plugin without an applied update to 20250115 or later remains vulnerable.

The issue can be triggered by an unauthenticated attacker through a crafted URL or form submission; no special credentials or elevated privileges are required. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. Without a patch, the risk is purely the typical impact of reflected XSS, which can be high depending on the target site’s user base and the attacker’s objectives.