Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: Supsystic Component: Popup Clear all filters
TI-2023-20889 CVE-2023-39997 · GHSA-j6f4-g5vh-36v8

WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control Vulnerability

Priority MEDIUM 49

Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00672 Published 2024-12-13 No fix listed CWE-862
TI-2023-28011 CVE-2023-51353 · GHSA-9j38-gh4r-29cw

WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerability

Priority HIGH 81

Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through <= 1.…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00572 Published 2024-12-09 No fix listed CWE-862
TI-2023-24824 CVE-2023-46197 · GHSA-5w4j-qp2j-2p4h

WordPress Popup by Supsystic plugin <= 1.10.19 - Unauthenticated Subscriber Email Addresses Disclosure

Priority LOW 34

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.This issue affects Popup by Supsystic: from n/a through 1.10…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01498 Published 2024-05-17 No fix listed CWE-22
TI-2023-02984 CVE-2023-3186 · GHSA-qrx9-x75w-xwj4

Supsystic Popup < 1.10.19 - Prototype Pollution

Priority HIGH 82

The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01454 Published 2023-07-17 Fixed in 1.10.19
TI-2017-14131 CVE-2017-20065 · GHSA-45cc-j36m-hxq2

Supsystic Popup Plugin cross-site request forgery

Priority MEDIUM 53

A vulnerability was found in Supsystic Popup Plugin 1.7.6 and classified as problematic.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00713 Published 2022-06-20 No fix listed CWE-352
TI-2022-00348 CVE-2022-0424 · GHSA-28vh-fggg-795m

Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure

Priority LOW 29

The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02849 Published 2022-05-09 Fixed in 1.10.9 CWE-306
TI-2021-06567 CVE-2021-24275 · GHSA-xh33-9j66-fv2x

Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)

Priority MEDIUM 45

The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.18165 Published 2021-05-05 Fixed in 1.10.5 CWE-79