CVE-2026-83625

Contact Form by Supsystic, a WordPress contact-form plugin, fails to sanitize and escape values taken from client-supplied IP-address headers such as X-Forwarded-For, leaving all versions up to and including 1.10.2 vulnerable to stored cross-site scripting (CWE-79). An unauthenticated attacker can obtain a valid nonce via the plugin's 'updateNonce' action, which is reachable without login because it is absent from the plugin's permission list, and then submit a contact form with a crafted IP header containing arbitrary web script. The payload is stored and executes in the browser of anyone who later views the page where the injected data is rendered, potentially allowing session hijacking or actions taken in that user's context, including a site administrator reviewing submissions. Any WordPress installation running the plugin at version 1.10.2 or earlier is affected. There is currently no public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation, with EPSS estimating only a 0.3% probability of exploitation within 30 days.

What to do: Update Contact Form by Supsystic to the newest available release (any version newer than 1.10.2). As an interim mitigation, strip or normalize client-supplied X-Forwarded-For headers at your CDN, reverse proxy, or WAF, and review stored contact-form submissions and pages that display them for unexpected scripts. Until patched, restrict viewing of submission IP data to trusted administrators.