Supsystic
38 CVEs across 35 Supsystic products. Browse Supsystic vulnerabilities, severities, and proof-of-concept exploits.
Supsystic products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27537 | Medium | 6.5 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions. |
CVE-2026-24628 | Medium | 5.9 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. |
CVE-2020-37246 | Medium | 6.2 | 2026-05-16 | Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating t… |
CVE-2020-37245 | High | 7.5 | 2026-05-16 | Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web ro… |
CVE-2020-37244 | High | 8.2 | 2026-05-16 | Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou… |
CVE-2020-37243 | High | 8.2 | 2026-05-16 | Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQ… |
CVE-2020-37242 | High | 8.2 | 2026-05-16 | Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2025-52753 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsy… |
CVE-2025-32138 | Medium | 6.6 | 2025-04-04 | Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps google-maps-easy allows XML Injection.This issue affects Easy… |
CVE-2024-56253 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in supsystic Data Tables Generator by Supsystic data-tables-generator-by-supsystic allows Exploiting Incorrectly Configured… |
CVE-2023-39997 | Medium | 5.3 | 2024-12-13 | Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2023-51353 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-52434 | Critical | 9.1 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsyst… |
CVE-2024-48046 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsy… |
CVE-2024-48042 | Critical | 9.1 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Co… |
CVE-2024-47330 | Medium | 4.3 | 2024-09-26 | Missing Authorization vulnerability in Supsystic Slider by Supsystic, Supsystic Social Share Buttons by Supsystic.This issue affects Slider by Supsystic: from… |
CVE-2024-5219 | Medium | 6.4 | 2024-07-02 | The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and includin… |
CVE-2024-32790 | Medium | 4.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Supsystic Pricing Table by Supsystic allows Code Injection.This… |
CVE-2023-46197 | Medium | 5.3 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal… |
CVE-2024-33910 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7. |
CVE-2024-32829 | Medium | 4.3 | 2024-04-26 | Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.1… |
CVE-2023-25043 | Medium | 4.3 | 2024-04-17 | Incorrect Authorization vulnerability in Supsystic Data Tables Generator.This issue affects Data Tables Generator: from n/a through 1.10.25. |
CVE-2024-31421 | Medium | 4.3 | 2024-04-15 | Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.This issue affects Popup by Supsystic: from n/a through <= 1.10.27. |
CVE-2024-32089 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a t… |
CVE-2024-31271 | Medium | 4.3 | 2024-04-12 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Ultimate Maps by Supsystic.This issue affects Ultimate Maps by Supsystic: from n/a through 1.2.16. |
CVE-2024-31269 | Medium | 4.3 | 2024-04-12 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps.This issue affects Easy Google Maps: from n/a through 1.11.11. |
CVE-2024-30448 | Medium | 5.9 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic Slider by Supsystic allows Stored XSS.This issu… |
CVE-2024-30237 | High | 7.6 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Supsystic Slider by Supsystic.This issue affects Slider b… |
CVE-2024-29921 | Medium | 5.9 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Photo Gallery by Supsystic gallery-by-supsystic… |
CVE-2023-6732 | Medium | 4.8 | 2024-01-16 | The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2023-49191 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored… |
CVE-2023-5756 | Medium | 5.4 | 2023-12-09 | The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to… |
CVE-2023-45068 | Medium | 5.4 | 2023-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions. |
CVE-2023-3186 | Critical | 9.8 | 2023-07-17 | The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into… |
CVE-2023-2526 | Medium | 5.4 | 2023-06-09 | The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.11.7. This is due to missing or incor… |
CVE-2023-33926 | High | 7.1 | 2023-05-28 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions. |
CVE-2023-22714 | Medium | 4.3 | 2023-05-22 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Coming Soon by Supsystic plugin <= 1.7.10 versions. |
CVE-2023-2528 | Medium | 5.4 | 2023-05-17 | The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing… |
CVE-2022-47155 | Medium | 4.3 | 2023-03-14 | Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Slider by Supsystic plugin <= 1.8.5 versions. |
CVE-2022-2384 | Medium | 4.8 | 2022-08-15 | The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to p… |
CVE-2022-33960 | High | 8.5 | 2022-07-22 | Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. |
CVE-2022-27235 | Medium | 6.3 | 2022-07-22 | Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. |
CVE-2022-2114 | Medium | 4.8 | 2022-07-17 | The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privileg… |
CVE-2022-1653 | Medium | 4.3 | 2022-06-27 | The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker t… |
CVE-2017-20065 | Medium | 4.3 | 2022-06-20 | A vulnerability was found in Supsystic Popup Plugin 1.7.6 and classified as problematic. This issue affects some unknown processing. The manipulation leads to… |
CVE-2021-36891 | Medium | 5.4 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin settings. |
CVE-2021-36890 | Medium | 4.3 | 2022-06-02 | Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress. |
CVE-2022-0424 | Medium | 5.3 | 2022-05-09 | The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers… |
CVE-2021-46782 | Medium | 6.1 | 2022-04-25 | The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard… |
CVE-2021-46780 | Medium | 6.1 | 2022-04-25 | The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading… |
CVE-2021-39346 | Medium | 4.8 | 2021-11-01 | The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters… |
CVE-2021-24276 | Medium | 6.1 | 2021-05-05 | The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leadi… |
CVE-2021-24275 | Medium | 6.1 | 2021-05-05 | The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a… |
CVE-2021-24274 | Medium | 6.1 | 2021-05-05 | The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leadi… |
CVE-2020-12076 | High | 8.8 | 2020-04-23 | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS. |
CVE-2020-12075 | High | 8.8 | 2020-04-23 | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. |
CVE-2020-9392 | High | 7.3 | 2020-03-23 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, creat… |
CVE-2020-9394 | High | 8.8 | 2020-02-25 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. |
CVE-2020-9393 | Medium | 6.1 | 2020-02-25 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS. |
CVE-2016-10918 | High | 8.8 | 2019-08-22 | The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF. |
CVE-2016-10915 | High | 8.8 | 2019-08-20 | The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. |
CVE-2017-18512 | High | 8.8 | 2019-08-14 | The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF. |