CVE-2026-115591

{
  "etk_id": "ETK-2026-2870",
  "cve_id": "CVE-2026-115591",
  "display_id": "CVE-2026-115591",
  "ghsa_id": "GHSA-92cm-w7hh-v85q",
  "euvd_id": "EUVD-2026-112068",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Sensitive data exposure in Contact Form by Supsystic",
  "summary": "Contact Form by Supsystic versions through 1.10.5 may expose sensitive data included in transmitted content. An unauthenticated remote attacker may be able to retrieve that data when the affected plugin is reachable over the network.",
  "mitigation": "Disable the affected plugin or restrict public network access to the site until an update is available. Monitor the vendor's releases and update promptly when a corrected version is published.",
  "vendor": "Supsystic",
  "product": "Contact Form by Supsystic",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.10.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "contact-form-by-supsystic",
      "purl": null
    }
  ],
  "cwes": [
    201
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.01100415,
  "t0_at": "2026-10-28T13:00:13.962000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T13:44:43.958728+00:00",
      "days": 0.030902739907407408,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T13:00:13.962000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T13:00:13.962000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T13:00:13.962000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115591"
    }
  }
}