{"id":"CVE-2026-8172","aliases":["EUVD-2026-38418","GHSA-x74w-29rh-ccvr"],"status":"published","title":"Simple Basic Contact Form \u003c= 20250114 - Reflected XSS","description":"The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00268,"percentile":0.19115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-06-23T06:00:02Z","modified":"2026-06-23T15:33:44Z","products":[{"vendor":"unknown","product":"simple basic contact form"}],"references":[{"url":"https://wpscan.com/vulnerability/535ec1a1-b822-43c9-8264-6442199493d3/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8172"},{"url":"https://wpscan.com/vulnerability/535ec1a1-b822-43c9-8264-6442199493d3"},{"url":"https://github.com/advisories/GHSA-x74w-29rh-ccvr"}],"sources":{"cve":[{"id":"CVE-2026-8172","title":"Simple Basic Contact Form \u003c= 20250114 - Reflected XSS","description":"The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.","status":"published","published":"2026-06-23T06:00:02.459Z","modified":"2026-06-23T12:27:37.658Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-38418","description":"The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.","status":"published","published":"2026-06-23T06:00:02Z","modified":"2026-06-23T12:27:37Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:20:33.850201Z"}],"ghsa":[{"id":"GHSA-x74w-29rh-ccvr","title":"The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied...","description":"The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.","status":"published","published":"2026-06-23T09:32:23Z","modified":"2026-06-23T15:33:44Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:08:56.903887Z"}],"nvd":[{"id":"CVE-2026-8172","description":"The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.","status":"published","published":"2026-06-23T07:16:21.007Z","modified":"2026-06-23T14:52:58.543Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:25.288279Z"}]}}