Contact Form by Supsystic vulnerabilities

3 known vulnerabilities in Contact Form by Supsystic from Supsysticcom. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Contact Form by Supsystic: Improper Neutralization of Input During Web Page Generation

  CVE-2026-83625Sep 5, 2026Supsysticcom

  The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenti

• 9.8 Critical severity

  Contact Form by Supsystic: Improper Control of Generation of Code

  CVE-2026-4257Mar 30, 2026SupsysticcomEPSS 41.5%

  The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` templat

• 8.8 High severity

  Contact Form by Supsystic: Cross-Site Request Forgery

  CVE-2023-2528May 17, 2023Supsysticcom

  The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated