CVE-2021-24275

The Popup by Supsystic WordPress plugin before version 1.10.5 is affected by a reflected XSS due to not sanitizing the tab parameter of its options page before outputting it in an attribute. This allows an attacker to inject scripts that run in the victim’s browser. The issue is mitigated by upgr...

CVE-2022-0424

The CVE-2022-0424 issue affects the Popup by Supsystic WordPress plugin, specifically versions prior to 1.10.9. The root cause is missing authentication/authorization in an AJAX action, permitting unauthenticated attackers to invoke the endpoint and retrieve the email addresses of subscribed user...

CVE-2023-46197

CVE-2023-46197: Path traversal vulnerability in Popup by Supsystic (WordPress plugin) allowing relative path traversal in versions up to 1.10.19. Exploitation path observed via getWpCsvList; unauthenticated access possible per Patchstack documenting arbitrary file download risk. Affected: Popup b...

CVE-2024-31421

CVE-2024-31421 concerns a Missing Authorization vulnerability in Supsystic Popup by Supsystic, affecting Popup by Supsystic versions up to 1.10.27 (no details on exposed actions). Root cause identified in connected Red Hat advisory as Missing Authorization. Public information in the provided docu...

CVE-2023-51353

CVE-2023-51353 affects the WordPress Popup by Supsystic plugin up to version 1.10.19. The root cause is broken/ missing authorization (Broken Access Control), enabling unauthenticated or low-privilege users to exploit access control to sensitive information via the getWpCsvList action. Reported i...

CVE-2023-3186

CVE-2023-3186 affects the Popup by Supsystic WordPress plugin prior to version 1.10.19. The issue is a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype. Public advisories cite a high-impact capability (prototype pollution) with a ...

CVE-2023-39997

CVE-2023-39997 concerns the WordPress plugin Popup by Supsystic. Affected versions up to 1.10.19 expose a missing authorization check (broken access control), allowing unauthenticated access. The issue is mitigated by upgrading to version 1.10.20 or later, which fixes the flaw.

CVE-2016-10915

The CVE-2016-10915 entry concerns the WordPress plugin Popup by Supsystic, specifically vulnerable in versions before 1.7.9. The issue is a Cross-Site Request Forgery (CSRF) flaw in the plugin, as documented by multiple sources (NVD entry for CVE-2016-10915 and Red Hat advisory). Affected compone...