Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Customer Engagement System 2.0.2 Clear all filters
TI-2026-81715 CVE-2026-115225 · GHSA-4r9j-p4gw-x3hm

Server-side request forgery in Customer Engagement System plugin

Priority LOW 32

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open…

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00245 Published 2026-10-28 Fixed in 2.0.2 CWE-918
TI-2026-81714 CVE-2026-115224 · GHSA-66pc-wp83-p27g

SQL injection in Smart Popup by Supsystic popup binding

Priority LOW 19

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INS…

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.0024 Published 2026-10-28 Fixed in 2.0.2 CWE-89