CVE-2026-8172

Name of the Vulnerable Software and Affected Versions Simple Basic Contact Form versions prior to 20250115

Description This issue occurs when the plugin fails to escape user-supplied input before reflecting it in the contact form output during validation errors. This leads to Reflected Cross-Site Scripting (XSS), a condition where a malicious script is reflected off a web application to the user's browser. Unauthenticated attackers can exploit this by using a crafted link or cross-site form submission to target site visitors.

Recommendations Update Simple Basic Contact Form to a version released after 20250114.