Executive brief
The Simple Basic Contact Form plugin for WordPress, which provides a standard contact form for websites, contains a security flaw that allows attackers to execute malicious scripts in a visitor's browser. By tricking a user into clicking a specially crafted link or visiting a malicious website, an attacker can steal session information or perform actions on behalf of the user. This could lead to unauthorized access to user accounts or the defacement of the website as seen by the victim.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Simple Basic Contact Form WordPress plugin (versions up to and including 20250114). The root cause is the failure to escape user-supplied input, such as the 'scf_email' field, before reflecting it back into the page when a validation error occurs. An unauthenticated attacker can exploit this by inducing a victim to submit a crafted POST request (e.g., via a cross-site form submission) containing malicious HTML attributes like 'onfocus'. This allows for the execution of arbitrary JavaScript in the context of the victim's browser session. As of the advisory date, no patch is available.
Affected products
- Unknown Simple Basic Contact Form <= 20250114
Timeline
- 2026-06-02: disclosed: Publicly published by WPScan
- 2026-06-23: advisory: CVE published to NVD dataset