11
CVEs
4
Critical
4
High
0
KEV
0
PoC
3
Unpatched C/H
54.5%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
4
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (22)
Wordpress Plugin
25
Popup
8
Easy Google Maps
7
PHP
5
Social Share Buttons
4
Popup By Supsystic
3
Ultimate Maps By Supsystic
3
Data Tables Generator
3
Pricing Table By Supsystic
3
Contact Form
3
Contact Form By Supsystic
2
Digital Publications By Supsystic
2
Ultimate Maps
2
Gdpr Cookie Consent
1
Coming Soon
1
Photo Gallery By Supsystic
1
Pricing Table
1
Membership
1
Backup
1
Digital Publications
1
Slider
1
Photo Gallery
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-73366 | Unauthenticated PHP object injection affects the Easy Google Maps WordPress plugin (vendor Supsystic) in all versions up to and including 1.13.0, letting remote attackers submit arbitrary serialized PHP objects that the application deserializes. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or full site takeover when a suitable property-oriented programming (POP) gadget chain is present in the plugin, WordPress core, or another active extension. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-73380 | Unauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remote attackers submit crafted serialized data that the plugin deserializes without validation. Reported by Patchstack and rated CVSS 9.8, the flaw is exploitable without authentication or user interaction; if a suitable POP gadget chain is present in the WordPress core, another plugin, or theme, it can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|
| CVE-2026-73376 | Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-73381 | Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-73377 | Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-73367 | Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-prerequisite attack surface makes this a meaningful priority for any site running the affected plugin. | HIGH | 7.2 | 0.2% | 36 |
|
| CVE-2026-73378 | Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-73375 | Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-73379 | Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes restricted plugin functionality to any remote attacker without credentials. CWE-288 indicates the plugin fails to enforce authentication through an alternate path or channel, allowing unauthorized access to operations that should require valid user context. No active exploitation confirmed by CISA KEV; patch is available as of version 1.10.0 per Patchstack and EUVD reporting. | MEDIUM | 6.5 | 0.2% | 33 |
|
| CVE-2026-27537 | Cross-site scripting in the Popup by Supsystic WordPress plugin (all versions up to and including 1.11.2) enables script injection into pages viewed by other users, with the injected code executing in the victim's browser under a changed scope. Reported by Patchstack and tracked as EUVD-2026-57935, the vulnerability carries a CVSS base score of 6.5 with Changed Scope, meaning successful exploitation crosses the security boundary between the plugin and the victim's browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible attack vector make it straightforward to weaponize given the right conditions. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-24628 | Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data. | MEDIUM | 5.9 | 0.2% | 30 |
No patch
|