CVE-2026-8172 — Simple Basic Contact Form <= 20250114 - Reflected XSS
The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leadi…
Published: 2026-06-23 · CVSS: 7.1 · CVSS 3.1
The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7