3.7
Low
CVE-2026-115303 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted…
Description
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Contact Form by Supsystic 1.11 | earliest → < 1.11.1 | 1.11.1 |
Other CVEs of Contact Form by Supsystic
The 6 CVEs of Contact Form by Supsystic →
CVE-2026-115302
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes…
5.3
Medium
CVE-2026-115301
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its…
7.2
High
CVE-2026-115300
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two…
4.3
Medium
CVE-2026-115299
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail…
5.4
Medium