Threats tagged 'ghsa-ghmm-gqr3-xwc7'

The Contact Form by Supsystic WordPress plugin versions prior to 1.11.1 improperly handle CR/LF characters and do not re-validate submitted field values before including them in email headers. This allows unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into notification emails.