Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 14 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2026 was the busiest year with 5 disclosures.
The most common weakness is Cross-Site Scripting, behind 7 of the records (50%). Other recurring categories include Code Injection, Cross-Site Request Forgery (CSRF).
Every one of the 14 issues recorded for Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics has a vendor fix available, so running the current release closes all known holes.
13 independent researchers contributed these findings, most of them (2) reported by Asim Alshaya. Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-4257Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
Read the full analysisVulnerability Records

Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
Author
supsystic
Contact Form by Supsystic is a drag-and-drop form builder for WordPress. Pick a template, add the fields you need, set what happens after the visitor clicks Send and paste the shortcode into any page. Submissions can be saved on your site, and built-in statistics show how many people saw the form and how many sent it. Unlimited forms, fields and submissions are free. Try it in your browser: open a live demo in WordPress Playground – no install, no account. Ready-made form templates Start from a designed template instead of a blank page: Base Contact, Simple White, Neon, Spearmint, Opacity Grey, Support Service, Time for Tea, holiday designs and more. Every template is fully editable. 25+ field types Text, email, number, URL and textarea Select box, select list, radio buttons and checkboxes Country list and multiple country list Date, time, month and week pickers Colour picker and range slider Google Map field Hidden fields and HTML / text delimiters Google reCAPTCHA Submit and reset buttons Mark any field as required, set placeholders and labels, and drag fields into the order you want. Design without code Form width in pixels or per cent Background colour or image for the form, the fields and the buttons Live preview of the form while you edit CSS and HTML code editor for full control What happens after Send Email notification to you, with your own subject, sender, Reply-To and message Copies to several email addresses A success message in your own colour, or a redirect to any page Hide the form after it is sent A test email button to check that your site sends mail Submissions and statistics Save every submission in the Contacts list on your site with one switch per form Export submissions to CSV Statistics for views, submits, successful sends and errors by hour, day, week or month Export the statistics to CSV Add forms anywhere Shortcode for posts, pages and widget areas Contact Form widget for sidebars Works with page builders and popup plugins through the shortcode Fully responsive on phones, tablets and desktops Contact Form Pro Pro adds advanced logic, fields and integrations: Conditional logic: show or hide fields based on earlier answers A/B testing of form variants Subscribe visitors to ConvertKit, ActiveCampaign, GetResponse, Constant Contact, Campaign Monitor, SendGrid, Salesforce and more WordPress user registration through a form Publish content: visitors submit posts from a form WooCommerce fields: product categories and product attributes such as size or colour File upload, rating, address search, WordPress editor and post category fields reCAPTCHA v3, hCaptcha and Cloudflare Turnstile Learn more Official plugin page Pro features Pricing Documentation
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C