Is CVE-2020-37245 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-37245 being exploited in the wild.

How severe is CVE-2020-37245?

High severity, with a CVSS score of 7.5, published 16 May 2026.

Which products and versions are affected?

Supsystic Digital Publications by Supsystic <= 1.6.9.

Is there a fix for CVE-2020-37245?

A patch was published on 2020-12-20: Vulnerability fixed by vendor after contact from WordPress Plugin Security team Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-37245 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-37245?

Check whether you run Supsystic Digital Publications by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37245: Supsystic Digital Publications Path Traversal and Stored XSS

Q: Is there a fix for CVE-2020-37245?

A patch was published on 2020-12-20: Vulnerability fixed by vendor after contact from WordPress Plugin Security team Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-37245 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2020-37245?

Check whether you run Supsystic Digital Publications by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37245 · Severity: high · CVSS 7.5 · Published 2026-05-16

Supsystic Digital Publications is a WordPress plugin used to create digital flipbooks and online publications. A security flaw in the plugin allows attackers to access sensitive files on the server that should be restricted, potentially exposing system information or user data. Additionally, the plugin is vulnerable to script injection, which could allow an attacker to hijack administrative sessions or deface the website when publications are viewed or edited.

Vendors: Supsystic.

Quick answers

Is CVE-2020-37245 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-37245 being exploited in the wild.
How severe is CVE-2020-37245?: High severity, with a CVSS score of 7.5, published 16 May 2026.
Which products and versions are affected?: Supsystic Digital Publications by Supsystic <= 1.6.9.
Is there a fix for CVE-2020-37245?: A patch was published on 2020-12-20: Vulnerability fixed by vendor after contact from WordPress Plugin Security team Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-37245 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-37245?: Check whether you run Supsystic Digital Publications by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Supsystic Digital Publications plugin for WordPress (version 1.6.9 and earlier) contains two primary vulnerabilities. First, a path traversal flaw exists in the 'Folder' input field within the Publications section; by injecting directory traversal sequences (e.g., ../), an attacker can use the readdir() function in utils.php to view files outside the web root. If the server attempts to read a directory without sufficient permissions, it may also trigger an infinite loop, leading to a Denial of Service (DoS) via log exhaustion. Second, the plugin fails to sanitize input fields in publication settings (such as Area Width and Publication Width), enabling stored Cross-Site Scripting (XSS). These scripts execute in the context of any user viewing or editing the affected publication. A fix was reportedly released around December 20, 2020.

Affected products

Supsystic Digital Publications by Supsystic <= 1.6.9

Timeline

2020-07-24: disclosed: Initial discovery and vendor notification by researcher Erik David Martin
2020-12-20: patched: Vulnerability fixed by vendor after contact from WordPress Plugin Security team
2021-02-08: other: Exploit-DB entry published
2026-05-16: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.