Vulnerabilities

TI-2023-24116 CVE-2023-45068 · GHSA-jp8v-q88c-wmpm

WordPress Contact Form by Supsystic Plugin <= 1.7.27 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00248 Published 2023-10-12 No fix listed CWE-352

TI-2023-02369 CVE-2023-2528 · GHSA-f2r8-gfhj-c6rg

Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action

LOW 38

The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0032 Published 2023-05-16 No fix listed CWE-352

TI-2021-06568 CVE-2021-24276 · GHSA-p8j5-xg8p-f3xm

Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

MEDIUM 44

The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.16044 Published 2021-05-05 Fixed in 1.7.15 CWE-79

Vulnerabilities

Filters

WordPress Contact Form by Supsystic Plugin <= 1.7.27 is vulnerable to Cross Site Request Forgery (CSRF)

Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action

Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)