WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting

WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. id: CVE-2021-24274 info: name: WordPress Supsystic Ultimate Ma...

Popup by Supsystic <1.10.5 - Cross-Site scripting

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. id: CVE-2021-24275 info: name: Popup by Supsystic 1.10.5 - Cross-Site scripting author: dhiyaneshDK severity:...

Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure

The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users id: CVE-2022-0424 info: name: Popup by Supsystic 1.10.9 - Subscriber Email...

CVE-2026-18322

CVE-2026-18322 — Escalada de privilegios en Smart Popup by Supsystic Investigación de seguridad sobre CVE-2026-18322 , una vulnerabilidad de escalada de privilegios no autenticada en el plugin de WordPress Smart Popup by Supsystic popup-by-supsystic. Este repositorio contiene un análisis de causa...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Falta de autorización que conduce a la exposición de información sensible Descripción "El plugin Popup by Supsystic para WordPress es vulnerable a la exposición de información sensible en todas las versiones hasta la 1.10.19 inclusive a través de la...

cve-2026-4257

CVE-2026-4257 Esto explota CVE-2026-4257, una vulnerabilidad de inyección de plantillas del lado del servidor SSTI en el plugin "Contact Form" de Wordpress de Supsystic en las versiones 1.7.36 y anteriores. Esta vulnerabilidad permite a un atacante no autenticado lograr la ejecución remota de...

CVE-2026-102397

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

EUVD-2026-90213

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-102397

The WordPress Ultimate Maps by Supsystic plugin, version 1.5.5 and below , is affected by an unauthenticated Broken Access Control vulnerability. While the vulnerability allows for unauthorized access, the provided documents do not specify the exact component, root cause, or practical consequence...

CVE-2026-102397 WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-102397 WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Ultimate Maps by Supsystic versions = 1.5.5...

CVE-2026-102396

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-102399

Unauthenticated Cross Site Request Forgery CSRF in Photo Gallery by Supsystic = 1.21.0 versions...

CVE-2026-102398

Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...

CVE-2026-102398

The Popup by Supsystic WordPress plugin (versions

CVE-2026-102399 WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Photo Gallery by Supsystic = 1.21.0 versions...

CVE-2026-102399

The Photo Gallery by Supsystic plugin for WordPress, version 1.21.0 and below , is vulnerable to an unauthenticated Cross Site Request Forgery (CSRF) . While the vulnerability is identified, the provided documents do not specify the exact root cause, affected functions, or specific remediation st...