Stored XSS in Contact Form by Supsystic

The Contact Form by Supsystic plugin for WordPress (versions 1.10.2 and earlier) contains a critical security flaw allowing for Stored Cross-Site Scripting (XSS). An unauthenticated attacker can exploit this vulnerability by manipulating HTTP headers, specifically the 'X-Forwarded-For' header, during the contact form submission process. Because the plugin fails to properly sanitize this input before storing and rendering it, injected JavaScript is executed within the browser of any user - including administrators - who views the malicious data in the WordPress dashboard or public-facing pages.

The vulnerability is compounded by a secondary issue involving the 'updateNonce' action, which lacks proper authentication checks. Attackers can leverage this to acquire a valid nonce, subsequently bypassing form protections to finalize the submission of the malicious XSS payload. Successful exploitation allows for account takeover, unauthorized administrative actions, or credential theft, depending on the privileges of the victim viewing the injected content.

Attack Chain

1. Attacker sends an unauthenticated HTTP GET/POST request to the target site to trigger the 'updateNonce' action.
2. The vulnerable plugin returns a valid nonce due to the absence of authentication checks on the 'updateNonce' endpoint.
3. Attacker crafts a malicious HTTP request containing a scripted payload (e.g., <script>alert(1)</script>) inside the 'X-Forwarded-For' header.
4. The request is submitted to the plugin's contact form endpoint, including the previously obtained nonce.
5. The plugin saves the form data, including the malicious script from the header, into the WordPress database without sanitization.
6. A victim (likely an administrator) accesses the WordPress dashboard or a page displaying the form submissions.
7. The browser renders the stored payload, executing the JavaScript in the context of the victim's session.
8. The script performs unauthorized actions or exfiltrates session data to the attacker-controlled endpoint.

Impact

Successful exploitation of this vulnerability enables unauthenticated attackers to execute arbitrary JavaScript in the browsers of users viewing the injected content. This poses a high risk to WordPress site administrators, as it can lead to full site compromise, unauthorized configuration changes, or the theft of administrative session cookies.

Recommendation

• Update the Contact Form by Supsystic plugin to a version patched against CVE-2026-83625 immediately.
• Implement Web Application Firewall (WAF) rules to inspect and sanitize 'X-Forwarded-For' headers for script tags and malicious characters.
• Audit WordPress administrative logs for suspicious requests to the 'updateNonce' action.
• Review all stored contact form submissions for signs of anomalous script injection if administrative access was potentially compromised.