660 matches found
WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting
WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...
WordPress Contact Form by Supsystic - Server-Side Template Injection
Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...
WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting
WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. id: CVE-2021-24274 info: name: WordPress Supsystic Ultimate Ma...
Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users id: CVE-2022-0424 info: name: Popup by Supsystic 1.10.9 - Subscriber Email...
Popup by Supsystic <1.10.5 - Cross-Site scripting
WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. id: CVE-2021-24275 info: name: Popup by Supsystic 1.10.5 - Cross-Site scripting author: dhiyaneshDK severity:...
CVE-2023-46197
CVE-2023-46197 Popup by Supsystic = 1.10.19 - 缺少授权导致敏感信息泄露 描述 "WordPress 的 Popup by Supsystic 插件在包括 1.10.19 在内的所有版本中，通过 getWpCsvList 操作存在敏感信息泄露漏洞。这使得拥有订阅者级别或更高级别权限的已认证攻击者能够提取包括订阅者电子邮件地址在内的敏感数据。" root@kitploit: reference: -...
cve-2026-4257
CVE-2026-4257 此漏洞利用 CVE-2026-4257，这是 Supsystic 开发的 "Contact Form" WordPress 插件 1.7.36 及之前版本中的一个服务器端模板注入（SSTI）漏洞。该漏洞允许未经身份验证的攻击者实现远程代码执行。 该漏洞存在于 formsViewCfs 类的 generateHtml 函数中，该函数通过任意一个适当类型的联系表单字段参数接收用户控制的输入。 已在 Ubuntu 24.04 和 Contact Form by Supsystic 1.7.36 版本上测试 Python 脚本选项 关于模块文档，请参见...
CVE-2026-83625
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
EUVD-2026-71934
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2026-83625
The Contact Form by Supsystic WordPress plugin (all versions up to and including 1.10.2 ) is vulnerable to unauthenticated stored XSS via insufficient input sanitization and output escaping. An attacker exploits the updateNonce action—accessible without authentication because it is absent from th...
CVE-2026-83625 Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2026-85309
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...
EUVD-2026-70553
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...
CVE-2026-85309 WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...
CVE-2026-85309
CVE-2026-85309 is a Missing Authorization (Broken Access Control) vulnerability in the Ultimate Maps by Supsystic WordPress plugin, affecting versions from unspecified through 1.5.3 . Unauthenticated attackers can exploit incorrectly configured access control security levels over the network with...
WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Ultimate Maps by Supsystic versions = 1.5.3...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...