CVE-2026-115303
Low
Description
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
SeverityLow
CVSS3.7
Exploit probability—
ProductContact Form by Supsystic
PublishedOct 29, 2026
First seenNov 4, 2026
Weakness typeCWE-93CWE-93
How to fix
Update
- Contact Form by Supsystic1.11.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Contact Form by Supsystic | v < 1.11.1 | 1.11.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.