Description

The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T08:16:40.857Z",
  "pubdate": "2026-09-05T08:16:40.857Z",
  "executiveSummary": "The Contact Form by Supsystic plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.10.2. The vulnerability arises from improper sanitization and output escaping of HTTP header data used to identify visitor IP addresses.\nUnauthenticated attackers can exploit this flaw to inject arbitrary JavaScript payloads into the plugin's administrative interface or frontend displays. By spoofing the 'X-Forwarded-For' header in a crafted HTTP request, an attacker forces the application to store malicious scripts within the database. When an administrator or user views the affected records, the payload executes in the context of their browser session.\nThe risk is critical due to the potential for administrative account compromise, session hijacking, and unauthorized data exfiltration. Because the plugin's 'updateNonce' action is accessible without authentication, the exploitation process is streamlined, allowing remote attackers to bypass initial security checks. This vulnerability requires no prior authentication, posing a significant risk to site integrity and user data confidentiality.",
  "technicalDetails": "The vulnerability resides within the plugin's handling of visitor IP addresses when processing contact form submissions. Specifically, the application fails to adequately sanitize or escape the data retrieved from HTTP headers, such as 'X-Forwarded-For', before storing it in the database. This creates a Stored XSS vector, as the malicious payload is persisted in the backend and subsequently rendered without sufficient output encoding.\nThe attack flow begins with the exploitation of the 'updateNonce' action. This action is improperly exposed to unauthenticated users, allowing an attacker to retrieve a valid security nonce necessary for further interaction with the plugin's submission handlers. Once a nonce is acquired, the attacker submits a contact form request while injecting a malicious JavaScript payload into the 'X-Forwarded-For' HTTP header. Because the plugin processes this header to log the user's IP, the unsanitized script is written directly into the WordPress database.\nThe impact is realized when an authenticated user—typically an administrator—navigates to the plugin's entries section to view contact form submissions. The WordPress administrative backend retrieves the stored, malicious IP entry and injects the script into the DOM. Since the output is not properly escaped, the browser interprets and executes the arbitrary script in the context of the administrator's active session. This allows the attacker to perform unauthorized actions on behalf of the administrator, such as creating new administrative accounts, altering site settings, or redirecting traffic.\nThe vulnerable component is the IP logging mechanism which trusts user-supplied HTTP header information implicitly. The scope of the vulnerability includes all versions up to 1.10.2. This vulnerability is classified as Stored XSS because the payload remains persistent on the server until manually removed by an administrator or through database correction. The attack vector is fully remote and requires no privilege level, making it highly accessible to attackers seeking to compromise WordPress installations utilizing this plugin."
}