CVE-2026-83625

Name of the Vulnerable Software and Affected Versions Contact Form by Supsystic versions prior to 1.10.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. An attacker can call the updateNonce() action to obtain a valid nonce and then submit a contact form containing a malicious payload within a spoofed IP header, such as X-Forwarded-For. These scripts execute whenever a user accesses the affected page.

Recommendations Update Contact Form by Supsystystic to version 1.10.3 or later.