Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Contact Form by Supsystic 1.11.1 Clear all filters
TI-2026-82317 CVE-2026-115303 · GHSA-ghmm-gqr3-xwc7

CRLF injection in Contact Form by Supsystic WordPress plugin

Priority LOW 17

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00224 Published 2026-10-29 Fixed in 1.11.1 CWE-93
TI-2026-82311 CVE-2026-115302 · GHSA-hpv3-cf4r-w5fw

Contact Form by Supsystic lets attackers delete statistics

Priority LOW 29

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entri…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00182 Published 2026-10-29 Fixed in 1.11.1 CWE-862
TI-2026-82310 CVE-2026-115301 · GHSA-vw93-qjx2-fxhw

Server-side template injection in Contact Form by Supsystic plugin

Priority LOW 34

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00422 Published 2026-10-29 Fixed in 1.11.1 CWE-94
TI-2026-82309 CVE-2026-115300 · GHSA-2663-mp38-cxqg

Missing CSRF checks in Contact Form by Supsystic let attackers delete data

Priority LOW 19

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, all…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00098 Published 2026-10-29 Fixed in 1.11.1 CWE-352
TI-2026-82308 CVE-2026-115299 · GHSA-r32v-cmjq-6cp5

CSRF in Contact Form by Supsystic lets attackers change mail settings

Priority LOW 23

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP serv…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00091 Published 2026-10-29 Fixed in 1.11.1 CWE-352