CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Reflected XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.36.
Explanation of Vulnerability in Simple Terms
Contact Form by Supsystic versions 1.7.36 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they view a form. The vulnerability requires user interaction—a victim must visit a page containing the malicious payload. The impact extends beyond the form itself to affect the broader site.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they view a form.
Potential impact on your site
Visitors' browsers can be compromised; attackers may steal session cookies, redirect users, or deface form content.
Conditions required to exploit
No authentication required. Victim must visit a page containing the malicious form payload.
Key dates
External resources
Related vulnerabilities
