Supsysticcom
Monthly
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's `updateNonce` action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted `X-Forwarded-For` value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Remote code execution in Contact Form by Supsystic plugin for WordPress (all versions ≤1.7.36) allows unauthenticated attackers to execute arbitrary PHP functions and OS commands via Server-Side Template Injection. Attackers exploit the plugin's unsandboxed Twig template engine by injecting malicious Twig expressions through GET parameters in the cfsPreFill functionality, leveraging registerUndefinedFilterCallback() to register arbitrary PHP callbacks. CVSS 9.8 (Critical) with network-accessible, low-complexity attack vector requiring no authentication. EPSS data not provided, but the combination of unauthenticated RCE in a widely-deployed WordPress plugin represents severe real-world risk. No KEV status confirmed at time of analysis.
Stored cross-site scripting in the Data Tables Generator by Supsystic WordPress plugin (all versions up to and including 1.12.03) allows an authenticated attacker holding contributor-level access or higher to inject arbitrary script into a table's id attribute, which is then stored and executed in the browser of any user - including an administrator - who views the affected page. The issue is rated CVSS 6.4 with a scope change (S:C) because the injected script executes in the security context of the hosting site rather than merely the plugin, giving the attacker a path to session theft, content tampering, or administrative action on behalf of the victim. No public exploit code and no confirmed active exploitation were identified at time of analysis, and an upstream fix has been committed to the plugin repository (changeset 3608322).
SQL injection in the 'sidx' parameter of the Smart Popup by Supsystic WordPress plugin (all versions up to and including 1.13.2) lets authenticated attackers with administrator-level privileges append arbitrary SQL statements to existing queries and extract sensitive data from the site's database. The CVSS vector confirms high privileges are required (PR:H) and impact is limited to confidentiality (C:H/I:N/A:N), and no public exploit or CISA KEV entry has been recorded - no public exploit identified at time of analysis - so despite a CVSS base score of 4.9 this is a low real-world-priority issue because an attacker must already hold the broad database and site access that administrators legitimately possess. Affected deployments are those running 1.13.2 or earlier; the vendor released 1.13.3 to remediate it.
Stored cross-site scripting in the WordPress plugin Data Tables Generator by Supsystic (all versions up to and including 1.15.1) allows an authenticated attacker holding a Subscriber-level or higher account to inject arbitrary JavaScript into a table cell's 'data' value through the updateRows action, which then executes in the browser of any user who views a page rendering that table. Reachability depends on a non-default precondition: an administrator must have deliberately added the attacker's low-privilege role to the plugin's 'access_roles' setting, which is a documented feature that hands those users the dtgs_nonce needed to call the vulnerable handler, so the exploitable population is meaningfully narrower than the raw base vector implies. No public exploit code has been identified at time of analysis and there is no KEV listing.
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's `updateNonce` action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted `X-Forwarded-For` value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Remote code execution in Contact Form by Supsystic plugin for WordPress (all versions ≤1.7.36) allows unauthenticated attackers to execute arbitrary PHP functions and OS commands via Server-Side Template Injection. Attackers exploit the plugin's unsandboxed Twig template engine by injecting malicious Twig expressions through GET parameters in the cfsPreFill functionality, leveraging registerUndefinedFilterCallback() to register arbitrary PHP callbacks. CVSS 9.8 (Critical) with network-accessible, low-complexity attack vector requiring no authentication. EPSS data not provided, but the combination of unauthenticated RCE in a widely-deployed WordPress plugin represents severe real-world risk. No KEV status confirmed at time of analysis.
Stored cross-site scripting in the Data Tables Generator by Supsystic WordPress plugin (all versions up to and including 1.12.03) allows an authenticated attacker holding contributor-level access or higher to inject arbitrary script into a table's id attribute, which is then stored and executed in the browser of any user - including an administrator - who views the affected page. The issue is rated CVSS 6.4 with a scope change (S:C) because the injected script executes in the security context of the hosting site rather than merely the plugin, giving the attacker a path to session theft, content tampering, or administrative action on behalf of the victim. No public exploit code and no confirmed active exploitation were identified at time of analysis, and an upstream fix has been committed to the plugin repository (changeset 3608322).
SQL injection in the 'sidx' parameter of the Smart Popup by Supsystic WordPress plugin (all versions up to and including 1.13.2) lets authenticated attackers with administrator-level privileges append arbitrary SQL statements to existing queries and extract sensitive data from the site's database. The CVSS vector confirms high privileges are required (PR:H) and impact is limited to confidentiality (C:H/I:N/A:N), and no public exploit or CISA KEV entry has been recorded - no public exploit identified at time of analysis - so despite a CVSS base score of 4.9 this is a low real-world-priority issue because an attacker must already hold the broad database and site access that administrators legitimately possess. Affected deployments are those running 1.13.2 or earlier; the vendor released 1.13.3 to remediate it.
Stored cross-site scripting in the WordPress plugin Data Tables Generator by Supsystic (all versions up to and including 1.15.1) allows an authenticated attacker holding a Subscriber-level or higher account to inject arbitrary JavaScript into a table cell's 'data' value through the updateRows action, which then executes in the browser of any user who views a page rendering that table. Reachability depends on a non-default precondition: an administrator must have deliberately added the attacker's low-privilege role to the plugin's 'access_roles' setting, which is a documented feature that hands those users the dtgs_nonce needed to call the vulnerable handler, so the exploitable population is meaningfully narrower than the raw base vector implies. No public exploit code has been identified at time of analysis and there is no KEV listing.