Vulnerability · Published Jun 23, 2026 · Assigned by WPScan
CVE-2026-8172Simple Basic Contact Form <= 20250114 - Reflected XSS
High 7.1
In plain English
A high-severity security flaw in Simple Basic Contact Form from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Simple Basic Contact Form | 0 – through 20250114 |
References
- https://wpscan.com/vulnerability/535ec1a1-b822-43c9-8264-6442199493d3/ exploit, vdb-entry, technical-description