Threat database

The Data Tables Generator by Supsystic WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.12.03. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts via the id attribute, which execute when other users view the affected pages. The issue arises from insufficient input sanitization and output escaping.

The Smart Popup by Supsystic WordPress plugin is vulnerable to SQL Injection via the 'sidx' parameter in versions up to and including 1.13.2. This vulnerability allows authenticated users with administrator-level privileges to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability has a medium severity rating with a CVSS score of 4.9.

The Data Tables Generator by Supsystic WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the updateRows action that allows authenticated users with subscriber-level access or higher to inject malicious scripts via table cell data. This vulnerability affects all versions up to and including 1.15.1. Exploitation requires that an administrator has explicitly granted the subscriber role access to the plugin's 'access_roles' setting, enabling them to reach the vulnerable action handler. The vulnerability can lead to script execution in the context of users visiting the injected pages.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.