Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics

Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 14 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (50%). Other recurring categories include Code Injection, Cross-Site Request Forgery (CSRF).

Every one of the 14 issues recorded for Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, most of them (2) reported by Asim Alshaya. Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891017.05.2016Today08.02.20218.8Contact Form by Supsystic <= 1.7.10 - SQL Injections CVSS 8.8 · 08.02.202119.04.20216.1Contact Form by Supsystic <= 1.7.14 - Reflected Cross-Site scripting CVSS 6.1 · 19.04.202128.10.20215.5Contact Form by Supsystic < 1.7.20 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 5.5 · 28.10.202116.05.20235.4Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action CVSS 5.4 · 16.05.202303.10.20234.3Contact Form by Supsystic <= 1.7.27 - Cross-Site Request Forgery CVSS 4.3 · 03.10.202313.10.20247.2Contact Form by Supsystic <= 1.7.28 - Authenticated (Admin+) Remote Code Execution CVSS 7.2 · 13.10.202414.10.20244.4Contact Form by Supsystic <= 1.7.28 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 14.10.202415.04.20256.1Contact Form by Supsystic <= 1.7.29 - Cross-Site Request Forgery to Stored Cross-Site Scripting via saveAsCopy AJAX Action CVSS 6.1 · 15.04.202518.08.20256.1Contact Form by Supsystic <= 1.7.36 - Reflected Cross-Site Scripting CVSS 6.1 · 18.08.202530.03.20269.8Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality CVSS 9.8 · 30.03.202618.08.20267.2Contact Form by Supsystic < 1.10.0 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 18.08.20265.3Contact Form by Supsystic < 1.10.0 - Unauthenticated Payment Bypass CVSS 5.3 · 18.08.202604.09.20267.2Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header CVSS 7.2 · 04.09.202626.10.20265.3Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics <= 1.10.7 - Missing Authorization CVSS 5.3 · 26.10.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

14

Get automatic notifications for all Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-4257

Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

Read the full analysis

Vulnerability Records

14 records
2026-10-26 10:35CVE-2026-115595
5.3
Medium
Mert UralYes
2026-09-04 19:31CVE-2026-83625
7.2
High
andrea bocchettiYes
2026-08-18 00:00CVE-2026-73378
7.2
High
Asim AlshayaYes
2026-08-18 00:00CVE-2026-73379
5.3
Medium
Asim AlshayaYes
2026-03-30 09:13CVE-2026-4257
9.8
Critical
Azril Fathoni (kiseki)Yes
2025-08-18 00:00CVE-2025-52753
6.1
Medium
63n0Yes
2025-04-15 14:00CVE-2024-13452
6.1
Medium
Tim CoenYes
2024-10-14 00:00CVE-2024-48046
4.4
Medium
UKOYes
2024-10-13 00:00CVE-2024-48042
7.2
High
HakiduckYes
2023-10-03 00:00CVE-2023-45068
4.3
Medium
Taihei ShimamineYes
Showing 1–10 of 14 reports
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics banner
Latestv1.11.1

Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics

supsystic

Author

supsystic

4.7(92)
94/100
Last Updated
2026-10-22 (6d ago)
Active Installs
6,000+
Downloads
665,776
Requires WP
0+
Requires PHP
7.3+
Tested up to
WP 7.1.3
Created
2016-05-17 (11y ago)

Contact Form by Supsystic is a drag-and-drop form builder for WordPress. Pick a template, add the fields you need, set what happens after the visitor clicks Send and paste the shortcode into any page. Submissions can be saved on your site, and built-in statistics show how many people saw the form and how many sent it. Unlimited forms, fields and submissions are free. Try it in your browser: open a live demo in WordPress Playground – no install, no account. Ready-made form templates Start from a designed template instead of a blank page: Base Contact, Simple White, Neon, Spearmint, Opacity Grey, Support Service, Time for Tea, holiday designs and more. Every template is fully editable. 25+ field types Text, email, number, URL and textarea Select box, select list, radio buttons and checkboxes Country list and multiple country list Date, time, month and week pickers Colour picker and range slider Google Map field Hidden fields and HTML / text delimiters Google reCAPTCHA Submit and reset buttons Mark any field as required, set placeholders and labels, and drag fields into the order you want. Design without code Form width in pixels or per cent Background colour or image for the form, the fields and the buttons Live preview of the form while you edit CSS and HTML code editor for full control What happens after Send Email notification to you, with your own subject, sender, Reply-To and message Copies to several email addresses A success message in your own colour, or a redirect to any page Hide the form after it is sent A test email button to check that your site sends mail Submissions and statistics Save every submission in the Contacts list on your site with one switch per form Export submissions to CSV Statistics for views, submits, successful sends and errors by hour, day, week or month Export the statistics to CSV Add forms anywhere Shortcode for posts, pages and widget areas Contact Form widget for sidebars Works with page builders and popup plugins through the shortcode Fully responsive on phones, tablets and desktops Contact Form Pro Pro adds advanced logic, fields and integrations: Conditional logic: show or hide fields based on earlier answers A/B testing of form variants Subscribe visitors to ConvertKit, ActiveCampaign, GetResponse, Constant Contact, Campaign Monitor, SendGrid, Salesforce and more WordPress user registration through a form Publish content: visitors submit posts from a form WooCommerce fields: product categories and product attributes such as size or colour File upload, rating, address search, WordPress editor and post category fields reCAPTCHA v3, hCaptcha and Cloudflare Turnstile Learn more Official plugin page Pro features Pricing Documentation

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C