CVE-2026-115223

The Smart Popup by Supsystic WordPress plugin versions prior to 2.0.2 is vulnerable to Server-Side Template Injection (SSTI) . The root cause is a logic flaw where a filter intended to strip template delimiters executes before a decoding step that reconstructs them. This allows an authenticated a...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...

CVE-2026-115225

The Customer Engagement System WordPress plugin versions before 2.0.2 is vulnerable to an unauthenticated SSRF (Server-Side Request Forgery) via the MailChimp interest-group lookup. The root cause is the failure to restrict access to this lookup and a lack of validation for the supplied API key. ...

CVE-2026-115225 Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response...

CVE-2026-115224 Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an...

CVE-2026-115224

The Customer Engagement System WordPress plugin (identified as Smart Popup by Supsystic ) versions before 2.0.2 is vulnerable to SQL Injection . The flaw occurs because the plugin fails to safely build SQL statements for storing a popup's page and category visibility rules, specifically by concat...

CVE-2026-18322

CVE-2026-18322 — Smart Popup by Supsystic Privilege Escalation Security research on CVE-2026-18322 , an unauthenticated privilege-escalation vulnerability in the WordPress plugin Smart Popup by Supsystic popup-by-supsystic. This repository contains a root-cause analysis derived from the upstream...

cve-2026-4257

CVE-2026-4257 This exploits CVE-2026-4257, a Server-Side Template Injection SSTI vulnerability in the "Contact Form" Wordpress plugin by Supsystic in versions 1.7.36 and before. This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution. The vulnerability exists in the...

Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure

The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users id: CVE-2022-0424 info: name: Popup by Supsystic 1.10.9 - Subscriber Email...

Popup by Supsystic <1.10.5 - Cross-Site scripting

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. id: CVE-2021-24275 info: name: Popup by Supsystic 1.10.5 - Cross-Site scripting author: dhiyaneshDK severity:...

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting

WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. id: CVE-2021-24274 info: name: WordPress Supsystic Ultimate Ma...

CVE-2026-115595

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7...

CVE-2026-115595 WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7...

CVE-2026-115595

The Contact Form by Supsystic WordPress plugin (versions up to and including 1.10.7 ) is vulnerable to a Broken Access Control issue (CWE-862). This Missing Authorization vulnerability allows for the exploitation of Incorrectly Configured Access Control Security Levels . No specific remediation o...

EUVD-2026-109737

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7...

WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mert Ural in WordPress Plugin Contact Form by Supsystic versions = 1.10.7...

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...

CVE-2025-15705

The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the...

CVE-2025-15705

The Contact Form by Supsystic WordPress plugin (versions before 1.8.0 ) contains a Stored XSS vulnerability due to a failure to properly sanitise and escape a form name. Attackers with access to the form editor can inject arbitrary web scripts that execute when other users view the form. In multi...