{
 "id": "WPSEC-2026-1519",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1519/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1519/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1519/index.md",
 "title": "Contact Form by Supsystic <= 1.10.7 - Unauthenticated Email Header Injection via Form Submission",
 "description": "The Contact Form by Supsystic plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 1.10.7 due to submitted form values being inserted into the To, Cc, From, Reply-To and Subject mail headers without stripping line breaks, and submitted select-box values being used as recipients without validation against the field's options. This makes it possible for unauthenticated attackers to inject additional email headers or change the recipients of notification emails, potentially abusing the site to send spam, when a form is configured to use submitted values in mail headers.",
 "plugin": {
  "slug": "contact-form-by-supsystic",
  "name": "Contact Form by Supsystic",
  "full_name": "Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics",
  "wordpress_org": "https://wordpress.org/plugins/contact-form-by-supsystic/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contact-form-by-supsystic/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contact-form-by-supsystic"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-93"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.11.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.11.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.11.1",
 "remediation": "Update to 1.11.1 or later.",
 "fix_released": "2026-10-22T12:53:32+00:00",
 "published": "2026-10-23T13:44:58+00:00",
 "updated": "2026-10-23T09:45:34.823063+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1519/",
  "https://plugins.svn.wordpress.org/contact-form-by-supsystic/tags/1.11.1/",
  "https://wordpress.org/plugins/contact-form-by-supsystic/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contact-form-by-supsystic",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}