Vendor
Supsystic vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 29 vulnerabilities in Supsystic: 2 in the last 7 days and 22 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110016, was published on 11 November 2026. 11 vulnerabilities in the last four weeks, up 38% on the four before (8). 5 technologies have a page of their own.
- Last 7 days
- 2
- Last 90 days
- 22
- Critical, all time
- 0
- Exploited in the wild
- 0
About Supsystic
A developer of plugins for the WordPress content management system.
Supsystic technologies
Latest Supsystic vulnerabilities
- CVE-2026-110016: Data Tables Generator by Supsystic IDOR via exposed nonceinfo
- CVE-2026-119484: Supsystic Photo Gallery CSRF in plugin settingsmediumCVSS 6.3
- CVE-2026-115302: Contact Form by Supsystic unauthorized statistics deletioninfo
- CVE-2026-115301: Contact Form by Supsystic server-side template injectioninfo
- CVE-2026-115300: Contact Form by Supsystic CSRF on form and statistics deletioninfo
- CVE-2026-115299: Contact Form by Supsystic CSRF in mail settingsinfo
- CVE-2026-115591: Supsystic Contact Form sensitive data exposure in sent datahighCVSS 7.5
- CVE-2026-115223: Smart Popup by Supsystic server-side template injection in popup text blockmediumCVSS 4.9
- CVE-2026-115225: Smart Popup by Supsystic SSRF in MailChimp lookupinfo
- CVE-2026-115224: Smart Popup by Supsystic SQL injection in popup page bindinginfo
- CVE-2026-115595: Supsystic Contact Form broken access controlmediumCVSS 5.3
- CVE-2025-15705: Contact Form by Supsystic stored XSS in form nameinfo
- CVE-2026-14877: Supsystic Data Tables Generator stored XSS via id attributemediumCVSS 6.4EPSS 0.2%
- CVE-2026-104023: Supsystic Smart Popup SQL injection in sidx parametermediumCVSS 4.9EPSS 0.4%
- CVE-2026-96648: Data Tables Generator by Supsystic stored cross-site scripting in table cell updatemediumCVSS 6.4EPSS 0.2%
- CVE-2026-102397: Supsystic Ultimate Maps broken access controlmediumCVSS 6.5
- CVE-2026-102399: Supsystic Photo Gallery unauthenticated CSRFmediumCVSS 5.4
- CVE-2026-102398: Supsystic Popup unauthenticated cross-site scriptinghighCVSS 7.1
- CVE-2026-102396: Supsystic Ultimate Maps cross-site scriptinghighCVSS 7.1
- CVE-2026-102395: Easy Google Maps unauthenticated cross-site scriptinghighCVSS 7.1
- CVE-2026-83625: Contact Form by Supsystic plugin stored cross-site scripting via IP headerhighCVSS 7.2EPSS 0.6%
- CVE-2026-85309: Supsystic Ultimate Maps broken access control vulnerabilitymediumCVSS 5.3EPSS 0.3%
- CVE-2026-18322: Supsystic Smart Popup privilege escalation via permission collisionhighCVSS 8.8EPSS 0.6%
- CVE-2026-24628: Supsystic Photo Gallery Administrator XSSmediumCVSS 5.9
- CVE-2020-37246: Supsystic Backup local file inclusion and arbitrary file deletionmediumCVSS 6.2
Most severe Supsystic vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-18322: Supsystic Smart Popup privilege escalation via permission collisionhighCVSS 8.8EPSS 0.6%
- CVE-2020-37244: Supsystic Membership SQL injection in badges modulehighCVSS 8.2
- CVE-2020-37243: Supsystic Pricing Table SQL injection and stored XSShighCVSS 8.2
- CVE-2020-37242: Supsystic Ultimate Maps SQL injection in sidx parameterhighCVSS 8.2
- CVE-2026-115591: Supsystic Contact Form sensitive data exposure in sent datahighCVSS 7.5
- CVE-2020-37245: Supsystic Digital Publications Path Traversal and Stored XSShighCVSS 7.5
- CVE-2026-83625: Contact Form by Supsystic plugin stored cross-site scripting via IP headerhighCVSS 7.2EPSS 0.6%
- CVE-2026-102398: Supsystic Popup unauthenticated cross-site scriptinghighCVSS 7.1
- CVE-2026-102396: Supsystic Ultimate Maps cross-site scriptinghighCVSS 7.1
- CVE-2026-102395: Easy Google Maps unauthenticated cross-site scriptinghighCVSS 7.1
Vulnerabilities per week
11 vulnerabilities in the last four weeks, up 38% on the four before (8). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 2 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 5 | 0 | |
| 5 Oct 2026 | 3 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 9 | 0 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 1 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Supsystic vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/supsystic)<a href="https://junglewise.ai/threats/vendors/supsystic"><img src="https://junglewise.ai/threats/vendors/supsystic/badge.svg" alt="Supsystic vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/supsystic.json, and this page as text at https://junglewise.ai/threats/vendors/supsystic.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Supsystic vulnerabilities", https://junglewise.ai/threats/vendors/supsystic, 12 November 2026.