CVE-2026-115223 Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

CVE-2026-115223

The Smart Popup by Supsystic WordPress plugin versions prior to 2.0.2 is vulnerable to Server-Side Template Injection (SSTI) . The root cause is a logic flaw where a filter intended to strip template delimiters executes before a decoding step that reconstructs them. This allows an authenticated a...