CVE-2026-115223
Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
| Vendor | unknown |
| Product | smart popup by supsystic |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown smart popup by supsystic
Be the first to know when new medium vulnerabilities affecting unknown smart popup by supsystic are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Smart Popup by Supsystic
0 < 2.0.2
References
Credits
Karthik Ramakrishnan WPScan