Vulnerabilities

TI-2026-86473 CVE-2026-119484 · GHSA-mcq5-3fm8-22gr

Cross-site request forgery in Supsystic Photo Gallery plugin

LOW 27

Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00121 Published 2026-11-07 No fix listed CWE-352

TI-2026-81965 CVE-2026-115591 · GHSA-92cm-w7hh-v85q

Sensitive data exposure in WordPress Contact Form by Supsystic plugin

LOW 39

Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00335 Published 2026-10-28 No fix listed CWE-201

TI-2026-80332 CVE-2026-115595 · GHSA-qhxh-2pc2-5gh9

Missing authorization in Contact Form by Supsystic WordPress plugin

LOW 29

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: f…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00229 Published 2026-10-26 No fix listed CWE-862

TI-2026-70144 CVE-2026-14877 · GHSA-23xr-vpxv-j5x3

Stored cross-site scripting in Data Tables Generator by Supsystic

LOW 27

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00152 Published 2026-10-10 No fix listed CWE-79

TI-2026-70246 CVE-2026-104023 · GHSA-f758-pjm7-xv29

SQL injection in Smart Popup by Supsystic via sidx parameter

LOW 23

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter a…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00433 Published 2026-10-10 No fix listed CWE-89

TI-2026-70206 CVE-2026-96648 · GHSA-wj3j-63m4-hxjx

Stored cross-site scripting in Data Tables Generator by Supsystic

LOW 28

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00228 Published 2026-10-10 No fix listed CWE-79

TI-2026-65388 CVE-2026-102397 · GHSA-ghhh-c933-5qf5

WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

LOW 34

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00159 Published 2026-09-30 No fix listed CWE-862

TI-2026-65390 CVE-2026-102399 · GHSA-w97r-9m4f-xmmm

WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability

LOW 23

Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00104 Published 2026-09-30 No fix listed CWE-352

TI-2026-65389 CVE-2026-102398 · GHSA-rvfw-xwr3-r2c8

WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-09-30 No fix listed CWE-79

TI-2026-65387 CVE-2026-102396 · GHSA-q72m-78gg-x9hj

WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-09-30 No fix listed CWE-79

TI-2026-65386 CVE-2026-102395 · GHSA-xjc9-93qh-85f6

WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-09-30 No fix listed CWE-79

TI-2026-57720 CVE-2026-83625 · GHSA-47p6-99pv-q7v3

Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header

LOW 38

The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escapin…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0058 Published 2026-09-05 No fix listed CWE-79

TI-2026-58580 CVE-2026-85309 · GHSA-6jpp-gxx7-g3pq

WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability

LOW 24

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00294 Published 2026-09-03 No fix listed CWE-862

TI-2026-51500 CVE-2026-73381 · GHSA-29w8-vv8g-hpgw

WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability

MEDIUM 46

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00549 Published 2026-08-18 No fix listed CWE-288

TI-2026-51499 CVE-2026-73380 · GHSA-66gj-6m2v-rp63

WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-18 No fix listed CWE-502

TI-2026-51498 CVE-2026-73379 · GHSA-pwm4-cfxp-wrgq

WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability

LOW 35

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00289 Published 2026-08-18 Fixed in 1.10.0 CWE-288

TI-2026-51497 CVE-2026-73378 · GHSA-pr7v-7wv9-4xjq

WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-18 Fixed in 1.10.0 CWE-79

TI-2026-51496 CVE-2026-73377 · GHSA-m9gp-f634-3ppc

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability

LOW 39

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00346 Published 2026-08-18 Fixed in 1.5.0 CWE-862

TI-2026-51495 CVE-2026-73376 · GHSA-22r5-47c6-39f8

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-18 Fixed in 1.5.0 CWE-502

TI-2026-51494 CVE-2026-73375 · GHSA-p37p-gp6p-9q27

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-18 Fixed in 1.5.0 CWE-79

TI-2026-51487 CVE-2026-73367 · GHSA-9q3x-m6g6-vvr5

WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability

LOW 38

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00333 Published 2026-08-18 Fixed in 1.14.2 CWE-829

TI-2026-51486 CVE-2026-73366 · GHSA-7qxw-c7q6-ppwj

WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

MEDIUM 50

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-08-18 No fix listed CWE-502

TI-2026-21931 CVE-2026-27537 · GHSA-qrg3-qvgr-8m6x

WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability

LOW 28

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00224 Published 2026-08-13 No fix listed CWE-79

TI-2026-15071 CVE-2026-18322 · GHSA-m4qm-m3w3-jjcg

Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator

MEDIUM 41

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00587 Published 2026-08-05 No fix listed CWE-269

TI-2026-19867 CVE-2026-24628 · GHSA-qj3m-ffgp-925j

WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability

LOW 26

Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.0024 Published 2026-07-23 No fix listed CWE-79

Vulnerabilities

Filters