Is Contact Form by Supsystic safe?

Every recorded flaw

• Oct 29, 2026Contact Form by Supsystic: Does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headersCVE-2026-115303 · fixed in 1.11.1 · reported by WPScanLow 3.7
• Oct 29, 2026Contact Form by Supsystic: Does not restrict access to an AJAX action that deletes stored form statistics recordsCVE-2026-115302 · fixed in 1.11.1 · reported by WPScan
• Oct 29, 2026Contact Form by Supsystic: Does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engineCVE-2026-115301 · fixed in 1.11.1 · reported by WPScan
• Oct 29, 2026Contact Form by Supsystic: Does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statisticsCVE-2026-115300 · fixed in 1.11.1 · reported by WPScan
• Oct 29, 2026Contact Form by Supsystic: Does not verify a CSRF nonce before saving its mail settingsCVE-2026-115299 · fixed in 1.11.1 · reported by WPScan
• Oct 28, 2026Contact Form by Supsystic: Insertion of Sensitive Information Into Sent DataCVE-2026-115591 · affects up to 1.10.5 · reported by PatchstackHigh 7.5
• Oct 26, 2026Contact Form by Supsystic: Missing AuthorizationCVE-2026-115595 · affects up to 1.10.7 · reported by PatchstackMedium 5.3
• Oct 25, 2026Contact Form by Supsystic: Does not sanitise and escape a form nameCVE-2025-15705 · fixed in 1.8.0 · reported by WPScanLow 3.5
• Sep 5, 2026Contact Form by Supsystic: Stored Cross-Site ScriptingCVE-2026-83625 · affects up to 1.10.2 · reported by WordfenceHigh 7.2
• Aug 18, 2026Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-73379 · reported by PatchstackMedium 6.5
• Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-73378 · reported by PatchstackHigh 7.1
• Mar 30, 2026Contact Form by Supsystic: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE)CVE-2026-4257 · affects up to 1.7.36 · reported by Wordfence41% oddsCritical 9.8
• Oct 22, 2025Contact Form by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52753 · affects up to 1.7.36 · reported by PatchstackHigh 7.1
• Apr 15, 2025Contact Form by Supsystic: Cross-Site Request ForgeryCVE-2024-13452 · affects up to 1.7.29 · reported by WordfenceMedium 6.1
• Oct 17, 2024Contact Form by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48046 · affects up to 1.7.28 · reported by PatchstackMedium 5.9
• Oct 16, 2024Contact Form by Supsystic: Deserialization of Untrusted DataCVE-2024-48042 · affects up to 1.7.28 · reported by Patchstack1.1% oddsCritical 9.1
• Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions.CVE-2023-45068 · affects up to 1.7.27 · reported by PatchstackMedium 5.4
• May 16, 2023Contact Form by Supsystic: Cross-Site Request ForgeryCVE-2023-2528 · affects up to 1.7.24 · reported by WordfenceMedium 5.4
• May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · fixed in 1.7.15 · reported by WPScan16% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.