Security Alert Summary
The Super Simple Contact Form WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability in the sscf_name parameter in all versions up to and including 1.6.2. Because input is not sufficiently sanitized or escaped on output, an unauthenticated attacker can craft a link that, when visited by a user, causes arbitrary script execution in that user’s browser.
CVE Details
- CVE ID: CVE-2026-0753
- Affected component: Super Simple Contact Form plugin for WordPress
- Affected versions: All versions up to, and including, 1.6.2
- Published: February 14, 2026 at 7:16:09 AM UTC
- Last modified: February 14, 2026 at 7:16:09 AM UTC
- CVSS v3.1 base score: 7.2 — HIGH
Vector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin fails to properly sanitize and escape user-supplied input for the sscf_name parameter. This reflected cross-site scripting (XSS) vulnerability allows an attacker to include arbitrary script payloads in a URL or form input that are then reflected into a page response and executed by a victim’s browser when they visit the crafted link.
The root cause is insufficient input validation and output escaping for the named parameter; the CVE description identifies the parameter sscf_name specifically. Successful exploitation relies on getting a target to load a crafted URL or otherwise trigger a response that reflects the attacker-controlled input back into the page context.
Impact is limited to script execution in the context of a victim’s browser (confidentiality and integrity impacts rated as low). There is no indication in the CVE entry of direct server-side compromise or availability impact.
How This Could Impact Your Website
In a realistic scenario, an attacker could send a crafted link to a site administrator, editor, contributor, or other site user. If a user with access to the site or its backend views the malicious link, the injected script could run in their browser and perform actions available to that user session, such as reading visible page content or performing actions the user is authorized to do within the browser context.
For example: a site owner or internal staff member might receive a link that, when clicked, reveals user-visible data (such as profile details or email addresses shown on pages) or performs actions in the user’s browser. External contractors or contributors who have lower privileges may still be targeted to harvest email addresses or perform social-engineering steps that could lead to follow-up attacks. The CVSS metrics indicate low confidentiality and integrity impacts, and no availability impact, so this should not be interpreted as an indication of full site compromise.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and permissions, especially for contributors and editors.
- Enforce strong passwords and enable two-factor authentication for administrators and editors.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior that might indicate attempted exploitation.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://downloads.wordpress.org/plugin/super-simple-contact-form.1.6.2.zip
- https://plugins.trac.wordpress.org/browser/super-simple-contact-form/tags/1.6.2/super-simple-contact-form.php#L152
- https://plugins.trac.wordpress.org/browser/super-simple-contact-form/trunk/super-simple-contact-form.php#L152
- https://wordpress.org/plugins/super-simple-contact-form/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e10c0d8d-718d-45dd-9ac3-a2673a6a16af?source=cve
