Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Contact Form by Supsystic CVE-2026-115303
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them int
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Contact Form by Supsystic CVE-2026-115302
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing u
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Contact Form by Supsystic CVE-2026-115301
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor conten
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Contact Form by Supsystic CVE-2026-115300
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delet
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Contact Form by Supsystic CVE-2026-115299
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite th
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
Contact Form by Supsystic CVE-2025-15705
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject a
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit