CVE-2026-115301 Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute...

CVE-2026-115301

The Contact Form by Supsystic WordPress plugin, in versions before 1.11.1 , is vulnerable to Server-Side Template Injection (SSTI) . The root cause is the lack of sandboxing for the template engine used to render forms, allowing stored form-editor content to be processed as executable template co...