73 matches found
CVE-2026-18322
CVE-2026-18322 — Smart Popup by Supsystic 权限提升 针对 CVE-2026-18322 的安全研究，这是 WordPress 插件 Smart Popup by Supsystic （popup-by-supsystic）中的一个未认证权限提升漏洞。本仓库包含基于上游源码差异的根因分析、提取出的补丁、用于识别受影响安装的检测工具（被动版本指纹识别器），以及一个用于漏洞利用 PoC 的实验环境。 该漏洞已公开且已修复。本工作成果以防御性用途发布：帮助运维人员发现并修复受影响的主机。 受影响版本 版本范围| 状态 ---|--- = 1.13.0|...
CVE-2023-46197
CVE-2023-46197 Supsystic의 팝업 = 1.10.19 - 민감한 정보 노출에 대한 인증 부족 설명 "WordPress용 Supsystic 플러그인의 팝업은 1.10.19까지의 모든 버전에서 getWpCsvList 액션을 통해 민감한 정보 노출에 취약합니다. 이로 인해 구독자 수준 이상의 인증된 공격자가 구독자 이메일 주소를 포함한 민감한 데이터를 추출할 수 있습니다." reference: -...
CVE-2026-102398
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...
CVE-2026-102398 WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...
CVE-2026-102398
The Popup by Supsystic WordPress plugin (versions
EUVD-2026-89945
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...
CVE-2026-102398 WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...
WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Popup by Supsystic versions = 1.13.1...
CVE-2026-102398: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...
PT-2026-103144
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...
VulnCheck KEV: CVE-2026-18322
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions function in classes/frame.php, where arraymerge overwrites the popup module's...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73381 WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73380 WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73380
CVE-2026-73380 is an unauthenticated PHP Object Injection vulnerability in the WordPress plugin Popup by Supsystic , affecting versions ≤ 1.13.0 . The vulnerability was discovered by Asim Alshaya and rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating full c...