CVE-2026-83625: Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Contact Form by Supsysticto a version that resolves this vulnerability.Fixed in 1.10.2 - Configuration
Update the plugin so the value derived from spoofable IP address headers (such as X-Forwarded-For) is properly sanitized before being stored/used and is properly escaped on output to prevent stored XSS.
WordPress plugin: Contact Form by Supsystic Input handling for IP address headers (e.g., X-Forwarded-For) = Sufficient input sanitization and output escaping
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate. They can obtain a valid nonce through the publicly accessible updateNonce action and then submit a contact form with a malicious value in a spoofed IP-related header, such as X-Forwarded-For.
Which deployments are affected?
All versions of Contact Form by Supsystic up to and including 1.10.2 are affected. The vulnerable behavior involves processing contact-form submissions and storing data derived from an IP address header.
What is required for the injected script to run?
The attacker must submit a contact form containing the payload through a spoofed IP header. The stored script executes when a user later accesses the page containing the injected content.
How can I check for possible exploitation?
Review contact-form submissions and related stored contact records for unexpected HTML or JavaScript, particularly in IP address fields or values derived from headers such as X-Forwarded-For. Look for submissions whose apparent IP value contains markup or script content.