CVE-2026-115303 Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

The Contact Form by Supsystic WordPress plugin (versions before 1.11.1 ) is vulnerable to unauthenticated CRLF / Email Header Injection . The root cause is the failure to strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers. This occur...