Executive brief
The Contact Form by Supsystic WordPress plugin stores user-supplied data from HTTP headers without proper filtering. An attacker can craft a contact form submission with malicious code in a spoofed IP address header, which will be permanently stored and executed in the browsers of anyone who views the form or its submissions. This allows attackers to steal session tokens, redirect users, or deface content without needing any special access or authentication.
Technical details
The plugin is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping of HTTP header data, specifically the X-Forwarded-For header used to capture visitor IP addresses. The vulnerability is exploitable without authentication because the 'updateNonce' action lacks proper permission checks, allowing attackers to obtain a valid nonce and submit a malicious contact form. An unauthenticated attacker can inject arbitrary JavaScript code via a spoofed IP header that will execute whenever the form or its stored data is accessed. The payload persists in the plugin's database, affecting all users who subsequently view the compromised page. Patches addressing input sanitization and output escaping should be applied immediately.
Affected products
- Supsystic Contact Form by Supsystic up to and including 1.10.2
Timeline
- 2026-09-05: disclosed