Supsystic
Monthly
Unauthenticated information disclosure in the Supsystic Contact Form WordPress plugin (all versions through 1.10.5) lets remote attackers retrieve sensitive data that the plugin embeds in the data it sends. The CVSS 3.1 score of 7.5 reflects network-only access with no privileges and no user interaction, high confidentiality impact, and no integrity or availability effect; vuln.today triage rates it this_week, i.e. moderate rather than emergency priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the precise endpoint, parameter, or output path that exposes the embedded data is not described in the available sources.
Unauthenticated reflected cross-site scripting (XSS) in Popup by Supsystic versions 1.13.1 and earlier allows remote attackers to inject malicious scripts that execute in a victim's browser when they interact with a crafted link or page. This affects WordPress sites with the plugin active, potentially leading to session hijacking, defacement, or data theft. The CVSS 3.1 score is 7.1 (High), and no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Unauthenticated cross-site scripting in the Easy Google Maps WordPress plugin (Supsystic, versions up to and including 1.14.6) allows remote attackers to inject and execute arbitrary script in a victim's browser session on any site where the plugin is installed and active. Exploitation requires the victim to interact - typically by clicking a crafted link or visiting an attacker-influenced page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) - and the advisory does not disclose the specific vulnerable parameter or sink, which limits precise targeting but not the underlying flaw. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a genuine but moderate-priority issue rather than an urgent one; impact escalates materially only when the interacting victim holds elevated privileges such as an administrator, where a single successful injection can lead to full site compromise.
Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify.
Unauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remote attackers submit crafted serialized data that the plugin deserializes without validation. Reported by Patchstack and rated CVSS 9.8, the flaw is exploitable without authentication or user interaction; if a suitable POP gadget chain is present in the WordPress core, another plugin, or theme, it can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-prerequisite attack surface makes this a meaningful priority for any site running the affected plugin.
Unauthenticated PHP object injection affects the Easy Google Maps WordPress plugin (vendor Supsystic) in all versions up to and including 1.13.0, letting remote attackers submit arbitrary serialized PHP objects that the application deserializes. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or full site takeover when a suitable property-oriented programming (POP) gadget chain is present in the plugin, WordPress core, or another active extension. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Missing authorization (CWE-862) in the WordPress plugin Contact Form by Supsystic, affecting all versions through 1.10.7, lets a remote attacker reach functionality that should have been gated by an access-control check without authenticating. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) confines the impact to low integrity - an attacker may be able to make some unauthorized modification, but cannot disclose data or disrupt availability through this flaw. The precise plugin feature or action that lacks the authorization check is not described in the available sources, and no public exploit has been identified at time of analysis; priority is rated this_month.
Unauthenticated attackers can exploit a broken access control flaw in the Ultimate Maps by Supsystic WordPress plugin through version 1.5.5, allowing network-reachable actions that should be restricted to authorized users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) indicates low confidentiality and integrity impact with no availability impact, and the provided intelligence contains no CISA KEV entry and no public exploit identified at time of analysis. Sites are affected only if the plugin is installed, active, and its vulnerable endpoint is reachable; the plugin's niche deployment and the lack of a documented privileged action limit, but do not eliminate, mass-exploitation risk.
Cross-site request forgery (CSRF) in the Supsystic Photo Gallery WordPress plugin through version 1.21.0 allows remote, unauthenticated attackers to make a logged-in administrator perform unintended state-changing actions within the plugin, such as modifying gallery settings or content, by tricking them into visiting a malicious page. Exploitation requires the victim to be authenticated and socially engineered into interacting with the attacker's page (UI:R), but the attacker needs no credentials (PR:N), and the impact is limited to low integrity and availability. No public exploit code has been identified, and no vendor patch is available at time of analysis.
Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes restricted plugin functionality to any remote attacker without credentials. CWE-288 indicates the plugin fails to enforce authentication through an alternate path or channel, allowing unauthorized access to operations that should require valid user context. No active exploitation confirmed by CISA KEV; patch is available as of version 1.10.0 per Patchstack and EUVD reporting.
Cross-site scripting in the Popup by Supsystic WordPress plugin (all versions up to and including 1.11.2) enables script injection into pages viewed by other users, with the injected code executing in the victim's browser under a changed scope. Reported by Patchstack and tracked as EUVD-2026-57935, the vulnerability carries a CVSS base score of 6.5 with Changed Scope, meaning successful exploitation crosses the security boundary between the plugin and the victim's browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible attack vector make it straightforward to weaponize given the right conditions.
Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting directory traversal. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx'. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'sidx' GET. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.10.19. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.10.19. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.10.29. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Supsystic Slider by Supsystic, Supsystic Social Share Buttons by Supsystic.8.6; Social Share Buttons by Supsystic: from n/a through 2.2.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.10.19. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 23.1% and no vendor patch available.
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.10.27. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps.11.11. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Photo Gallery by Supsystic gallery-by-supsystic.15.16. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.1.2. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Coming Soon by Supsystic plugin <= 1.7.10 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated information disclosure in the Supsystic Contact Form WordPress plugin (all versions through 1.10.5) lets remote attackers retrieve sensitive data that the plugin embeds in the data it sends. The CVSS 3.1 score of 7.5 reflects network-only access with no privileges and no user interaction, high confidentiality impact, and no integrity or availability effect; vuln.today triage rates it this_week, i.e. moderate rather than emergency priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the precise endpoint, parameter, or output path that exposes the embedded data is not described in the available sources.
Unauthenticated reflected cross-site scripting (XSS) in Popup by Supsystic versions 1.13.1 and earlier allows remote attackers to inject malicious scripts that execute in a victim's browser when they interact with a crafted link or page. This affects WordPress sites with the plugin active, potentially leading to session hijacking, defacement, or data theft. The CVSS 3.1 score is 7.1 (High), and no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Unauthenticated cross-site scripting in the Easy Google Maps WordPress plugin (Supsystic, versions up to and including 1.14.6) allows remote attackers to inject and execute arbitrary script in a victim's browser session on any site where the plugin is installed and active. Exploitation requires the victim to interact - typically by clicking a crafted link or visiting an attacker-influenced page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) - and the advisory does not disclose the specific vulnerable parameter or sink, which limits precise targeting but not the underlying flaw. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a genuine but moderate-priority issue rather than an urgent one; impact escalates materially only when the interacting victim holds elevated privileges such as an administrator, where a single successful injection can lead to full site compromise.
Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify.
Unauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remote attackers submit crafted serialized data that the plugin deserializes without validation. Reported by Patchstack and rated CVSS 9.8, the flaw is exploitable without authentication or user interaction; if a suitable POP gadget chain is present in the WordPress core, another plugin, or theme, it can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-prerequisite attack surface makes this a meaningful priority for any site running the affected plugin.
Unauthenticated PHP object injection affects the Easy Google Maps WordPress plugin (vendor Supsystic) in all versions up to and including 1.13.0, letting remote attackers submit arbitrary serialized PHP objects that the application deserializes. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or full site takeover when a suitable property-oriented programming (POP) gadget chain is present in the plugin, WordPress core, or another active extension. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Missing authorization (CWE-862) in the WordPress plugin Contact Form by Supsystic, affecting all versions through 1.10.7, lets a remote attacker reach functionality that should have been gated by an access-control check without authenticating. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) confines the impact to low integrity - an attacker may be able to make some unauthorized modification, but cannot disclose data or disrupt availability through this flaw. The precise plugin feature or action that lacks the authorization check is not described in the available sources, and no public exploit has been identified at time of analysis; priority is rated this_month.
Unauthenticated attackers can exploit a broken access control flaw in the Ultimate Maps by Supsystic WordPress plugin through version 1.5.5, allowing network-reachable actions that should be restricted to authorized users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) indicates low confidentiality and integrity impact with no availability impact, and the provided intelligence contains no CISA KEV entry and no public exploit identified at time of analysis. Sites are affected only if the plugin is installed, active, and its vulnerable endpoint is reachable; the plugin's niche deployment and the lack of a documented privileged action limit, but do not eliminate, mass-exploitation risk.
Cross-site request forgery (CSRF) in the Supsystic Photo Gallery WordPress plugin through version 1.21.0 allows remote, unauthenticated attackers to make a logged-in administrator perform unintended state-changing actions within the plugin, such as modifying gallery settings or content, by tricking them into visiting a malicious page. Exploitation requires the victim to be authenticated and socially engineered into interacting with the attacker's page (UI:R), but the attacker needs no credentials (PR:N), and the impact is limited to low integrity and availability. No public exploit code has been identified, and no vendor patch is available at time of analysis.
Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes restricted plugin functionality to any remote attacker without credentials. CWE-288 indicates the plugin fails to enforce authentication through an alternate path or channel, allowing unauthorized access to operations that should require valid user context. No active exploitation confirmed by CISA KEV; patch is available as of version 1.10.0 per Patchstack and EUVD reporting.
Cross-site scripting in the Popup by Supsystic WordPress plugin (all versions up to and including 1.11.2) enables script injection into pages viewed by other users, with the injected code executing in the victim's browser under a changed scope. Reported by Patchstack and tracked as EUVD-2026-57935, the vulnerability carries a CVSS base score of 6.5 with Changed Scope, meaning successful exploitation crosses the security boundary between the plugin and the victim's browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible attack vector make it straightforward to weaponize given the right conditions.
Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting directory traversal. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx'. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'sidx' GET. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.10.19. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.10.19. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.10.29. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Supsystic Slider by Supsystic, Supsystic Social Share Buttons by Supsystic.8.6; Social Share Buttons by Supsystic: from n/a through 2.2.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.10.19. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 23.1% and no vendor patch available.
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.10.27. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps.11.11. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Photo Gallery by Supsystic gallery-by-supsystic.15.16. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.1.2. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Coming Soon by Supsystic plugin <= 1.7.10 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.