# CVE-2020-37243: Supsystic Pricing Table SQL injection and stored XSS

Source: https://junglewise.ai/threats/cve-2020-37243-supsystic-pricing-table-sql-injection-and-stored-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-16. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2020-37243 · Severity: high · CVSS 8.2 · Published 2026-05-16

The Supsystic Pricing Table plugin for WordPress, which is used to create comparison and pricing charts, contains security flaws that allow attackers to manipulate the website's database. An unauthenticated attacker can use these flaws to extract sensitive information from the database or inject malicious scripts that target site visitors. This could lead to data theft, unauthorized access to the website's backend, or the compromise of user sessions.

Vendors: [Supsystic](https://junglewise.ai/threats/vendors/supsystic).

## Quick answers

**Is CVE-2020-37243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37243 being exploited in the wild.

**How severe is CVE-2020-37243?** High severity, with a CVSS score of 8.2, published 16 May 2026.

**Which products and versions are affected?** Supsystic Pricing Table by Supsystic <= 1.8.7.

**Is there a fix for CVE-2020-37243?** A patch was published on 2020-12-07: Vulnerability reportedly patched following contact with WordPress Plugin Security team Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-37243 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2020-37243?** Check whether you run Supsystic Pricing Table by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Supsystic Pricing Table plugin (versions 1.8.7 and below) is vulnerable to unauthenticated SQL injection and stored cross-site scripting. The SQL injection exists in the 'sidx' GET parameter during the 'getListForTbl' action, where user input is not properly sanitized before being used in a database query; this allows for boolean-based and time-based blind SQL injection. Additionally, the plugin fails to sanitize the 'Edit name' and 'Edit HTML' fields, allowing authenticated users (or those with access to the table editor) to inject malicious JavaScript. These scripts execute when a user views the pricing table or the 'Show All Tables' section in the admin dashboard. A patch was reportedly released around December 2020.

## Affected products

- Supsystic Pricing Table by Supsystic <= 1.8.7

## Timeline

- 2020-07-24: disclosed: Vulnerability discovered by researcher Erik David Martin
- 2020-07-25: other: Vendor notified of the vulnerabilities
- 2020-12-07: patched: Vulnerability reportedly patched following contact with WordPress Plugin Security team
- 2021-02-08: other: Exploit code published on Exploit-DB
- 2026-05-16: advisory: NVD/VulnCheck advisory published

## References

- [https://downloads.wordpress.org/plugin/pricing-table-by-supsystic.1.8.7.zip](https://downloads.wordpress.org/plugin/pricing-table-by-supsystic.1.8.7.zip)
- [https://supsystic.com/](https://supsystic.com/)
- [https://www.exploit-db.com/exploits/49533](https://www.exploit-db.com/exploits/49533)
- [https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-pricing-table-sql-injection-xss](https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-pricing-table-sql-injection-xss)