contact_form_by_supsystic vulnerabilities
CVEs whose affected-version data names the contact_form_by_supsystic package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-115299Medium· 5.4Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credenti…
CVE-2026-115301High· 7.2Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator…
CVE-2026-115300Medium· 4.3Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers …
CVE-2026-115302Medium· 5.3Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
CVE-2026-115303Low· 3.7Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field i…
CVE-2025-15705Low· 3.5Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multis…