---
id: "CVE-2026-115591"
kind: "vulnerability"
aliases: ["CVE-2026-115591"]
title: "Supsystic Contact Form: plugin leaks embedded sensitive data in responses"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-28T13:17:04+00:00"
first_seen_at: "2026-10-28T13:33:00+00:00"
updated_at: "2026-10-28T13:34:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115591", "first_seen_at": "2026-10-28T13:33:00+00:00"}]
---

# Supsystic Contact Form: plugin leaks embedded sensitive data in responses

The Contact Form by Supsystic WordPress plugin, through version 1.10.5, inserts sensitive information into data it sends to visitors. An attacker can retrieve that embedded sensitive data from the plugin's output.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Contact Form by Supsystic (contact-form-by-supsystic) in the WordPress plugins screen or `wp plugin get contact-form-by-supsystic --field=version`
- unknown whether the sources name the exact sensitive fields exposed

## Fix

- Update Contact Form by Supsystic to a version later than `1.10.5` once a fixed release is confirmed
- unknown whether a patched version number is given in the sources

## Timeline

- 2026-10-28T13:33:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115591

## From the sources

Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_