WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting

WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. id: CVE-2021-24274 info: name: WordPress Supsystic Ultimate Ma...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure

The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users id: CVE-2022-0424 info: name: Popup by Supsystic 1.10.9 - Subscriber Email...

Popup by Supsystic <1.10.5 - Cross-Site scripting

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. id: CVE-2021-24275 info: name: Popup by Supsystic 1.10.5 - Cross-Site scripting author: dhiyaneshDK severity:...

CVE-2026-18322

CVE-2026-18322 — Escalada de privilegios en Smart Popup by Supsystic Investigación de seguridad sobre CVE-2026-18322 , una vulnerabilidad de escalada de privilegios no autenticada en el plugin de WordPress Smart Popup by Supsystic popup-by-supsystic. Este repositorio contiene un análisis de causa...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - 缺少授权导致敏感信息泄露 描述 "WordPress 的 Popup by Supsystic 插件在包括 1.10.19 在内的所有版本中，通过 getWpCsvList 操作存在敏感信息泄露漏洞。这使得拥有订阅者级别或更高级别权限的已认证攻击者能够提取包括订阅者电子邮件地址在内的敏感数据。" reference: -...

cve-2026-4257

CVE-2026-4257 Esto explota CVE-2026-4257, una vulnerabilidad de inyección de plantillas del lado del servidor SSTI en el plugin "Contact Form" de Wordpress de Supsystic en las versiones 1.7.36 y anteriores. Esta vulnerabilidad permite a un atacante no autenticado lograr la ejecución remota de...

CVE-2026-102397

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

EUVD-2026-90213

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-102397

The WordPress Ultimate Maps by Supsystic plugin, version 1.5.5 and below , is affected by an unauthenticated Broken Access Control vulnerability. While the vulnerability allows for unauthorized access, the provided documents do not specify the exact component, root cause, or practical consequence...

CVE-2026-102397 WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-102397 WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Ultimate Maps by Supsystic versions = 1.5.5...

CVE-2026-102396

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-102399

Unauthenticated Cross Site Request Forgery CSRF in Photo Gallery by Supsystic = 1.21.0 versions...

CVE-2026-102398

Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...

CVE-2026-102398

The Popup by Supsystic WordPress plugin (versions

CVE-2026-102399

The Photo Gallery by Supsystic plugin for WordPress, version 1.21.0 and below , is vulnerable to an unauthenticated Cross Site Request Forgery (CSRF) . While the vulnerability is identified, the provided documents do not specify the exact root cause, affected functions, or specific remediation st...

CVE-2026-102399 WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Photo Gallery by Supsystic = 1.21.0 versions...