651 matches found
WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting
WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. id: CVE-2021-24274 info: name: WordPress Supsystic Ultimate Ma...
WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting
WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...
WordPress Contact Form by Supsystic - Server-Side Template Injection
Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...
Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users id: CVE-2022-0424 info: name: Popup by Supsystic 1.10.9 - Subscriber Email...
Popup by Supsystic <1.10.5 - Cross-Site scripting
WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. id: CVE-2021-24275 info: name: Popup by Supsystic 1.10.5 - Cross-Site scripting author: dhiyaneshDK severity:...
cve-2026-4257
CVE-2026-4257 이것은 Supsystic의 "Contact Form" Wordpress 플러그인 버전 1.7.36 및 이전 버전에서 발견된 서버 측 템플릿 인젝션SSTI 취약점인 CVE-2026-4257을 악용합니다. 이 취약점으로 인해 인증되지 않은 공격자가 원격 코드 실행을 달성할 수 있습니다. 이 취약점은 formsViewCfs 클래스의 generateHtml 함수에 존재하며, 이 함수는 적절한 유형의 Contact Form 필드 매개변수 중 하나를 통해 사용자 제어 입력을 받아들입니다. Ubuntu 24.04 ...
CVE-2023-46197
CVE-2023-46197 Popup by Supsystic = 1.10.19 - Fehlende Autorisierung zur Offenlegung sensibler Informationen Beschreibung „Das Popup by Supsystic Plugin für WordPress ist in allen Versionen bis einschließlich 1.10.19 über die getWpCsvList-Aktion anfällig für die Offenlegung sensibler Informatione...
CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73375
Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73379
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-73376
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73377
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73378
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-73381 WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73380
CVE-2026-73380 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Popup by Supsystic , affecting versions ≤ 1.13.0 . The vulnerability was discovered by Asim Alshaya and rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating full c...
EUVD-2026-60796
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73380 WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
