CVE-2020-37243
WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables.
| CWE | CWE-89 |
| Vendor | supsystic |
| Product | pricing table |
| Published | May 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for supsystic pricing table
Be the first to know when new high vulnerabilities affecting supsystic pricing table are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
Supsystic / Pricing Table
1.8.6 1.8.7
References
exploit-db.com: https://www.exploit-db.com/exploits/49533 supsystic.com: https://supsystic.com/ downloads.wordpress.org: https://downloads.wordpress.org/plugin/pricing-table-by-supsystic.1.8.7.zip vulncheck.com: https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-pricing-table-sql-injection-xss
Credits
Erik David Martin