CVE-2026-0753
Reflected XSS in Super Simple Contact Form Plugin
Publication date: 2026-02-14
Last updated on: 2026-02-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bitacre | super_simple_contact_form | to 1.6.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
The vulnerability in the Super Simple Contact Form WordPress plugin (up to version 1.6.2) is a Reflected Cross-Site Scripting (XSS) issue via the 'sscf_name' parameter. This happens because the plugin does not properly sanitize or escape user input before displaying it, allowing an attacker to inject malicious scripts.
An unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted link, causing the injected script to execute in the user's browser.
How can this vulnerability impact me? :
This vulnerability can lead to several impacts including the execution of arbitrary scripts in the context of the victim's browser. This can result in theft of user credentials, session hijacking, defacement of the website, or redirection to malicious sites.
Because the attacker does not need to be authenticated, any visitor to a vulnerable site can be targeted, increasing the risk of widespread exploitation.
The CVSS score of 7.2 (High) reflects the significant risk posed by this vulnerability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "The vulnerability in the Super Simple Contact Form plugin (up to version 1.6.2) is a Reflected Cross-Site Scripting (XSS) via the 'sscf_name' parameter due to insufficient input sanitization and output escaping."}, {'type': 'paragraph', 'content': "To detect this vulnerability on your system, you can test if the plugin is installed and active in your WordPress environment and then attempt to inject a simple script payload into the 'sscf_name' parameter of the contact form to see if it is reflected unsanitized in the response."}, {'type': 'paragraph', 'content': "Example commands to detect the vulnerability might include using curl or a browser to submit a form or URL with a payload such as: <script>alert(1)</script> in the 'sscf_name' parameter and observing if the script executes or is reflected in the page source."}, {'type': 'list_item', 'content': 'curl -X POST -d "sscf_name=<script>alert(1)</script>&[email protected]&sscf_message=test" https://your-wordpress-site/contact-page-url'}, {'type': 'list_item', 'content': 'Use a web proxy or browser developer tools to inspect the response for reflected script tags or unsanitized input in the contact form output.'}, {'type': 'paragraph', 'content': 'Additionally, scanning your WordPress plugins for the presence of the Super Simple Contact Form plugin version 1.6.2 or earlier can help identify vulnerable installations.'}] [2, 4]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps for CVE-2026-0753 include:'}, {'type': 'list_item', 'content': 'Disable or deactivate the Super Simple Contact Form plugin if it is installed and currently active.'}, {'type': 'list_item', 'content': 'If possible, update the plugin to a version that fixes the vulnerability. However, the plugin has been closed as of February 12, 2026, pending a full review, so no updated version may be available.'}, {'type': 'list_item', 'content': "Implement Web Application Firewall (WAF) rules to block or sanitize requests containing suspicious script payloads targeting the 'sscf_name' parameter."}, {'type': 'list_item', 'content': 'Educate users to avoid clicking on suspicious links that might exploit this reflected XSS vulnerability.'}, {'type': 'paragraph', 'content': 'Long term, consider replacing the plugin with a more secure contact form plugin that properly sanitizes and escapes user input.'}] [1, 2, 4]