Contact Form by Supsystic: Form-name stored cross-site scripting
Contact Form by Supsystic fails to sanitize and escape form names. A user with access to the form editor can store script in a form name that executes when another user views the form. On multisite, this crosses a privilege boundary because site administrators lack unfiltered_html. The minimum role outside that scenario, save action and output context are not disclosed in the export. Published affected versions: < 1.8.0.
- Component
- Contact Form by Supsystic
- Plugin slug
contact-form-by-supsystic- Affected
- < 1.8.0
- Safe version
1.8.0- Published
- Oct 25, 2026
- Weakness
- Not assigned
This CVE was published Oct 25, 2026 and is one of 11 known issues for this plugin.
Update, patch or deactivate.
Update Contact Form by Supsystic to 1.8.0 or later. Sanitize form names and escape them for each rendering context, respecting multisite markup restrictions. Restrict untrusted form-editor access, remove injected names and review affected users’ sessions.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.