Is Customer Engagement System safe?

Every recorded flaw

• Oct 28, 2026Smart Popup by Supsystic: Does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engineCVE-2026-115223 · fixed in 2.0.2 · reported by WPScanMedium 4.9
• Oct 28, 2026Customer Engagement System: Does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to itCVE-2026-115225 · fixed in 2.0.2 · reported by WPScanMedium 5.8
• Oct 28, 2026Customer Engagement System: Does not safely build the SQL statements that store a popup's page and category visibility rulesCVE-2026-115224 · fixed in 2.0.2 · reported by WPScanMedium 4.1
• Oct 10, 2026Smart Popup by Supsystic: Generic SQL InjectionCVE-2026-104023 · affects up to 1.13.2 · reported by WordfenceMedium 4.9
• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.CVE-2026-102398 · affects up to 1.13.1 · reported by PatchstackHigh 7.1
• Aug 18, 2026Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73381 · affects up to 1.13.0 · reported by PatchstackCritical 9.1
• Aug 18, 2026Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73380 · affects up to 1.13.0 · reported by PatchstackCritical 9.8
• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.CVE-2026-27537 · affects up to 1.11.2 · reported by PatchstackMedium 6.5
• Aug 5, 2026Smart Popup by Supsystic: Privilege EscalationCVE-2026-18322 · affects up to 1.12.0 · reported by WordfenceHigh 8.8
• Dec 13, 2024Popup by Supsystic: Missing AuthorizationCVE-2023-39997 · affects up to 1.10.19 · reported by PatchstackMedium 5.3
• Dec 9, 2024Popup by Supsystic: Missing AuthorizationCVE-2023-51353 · affects up to 1.10.19 · reported by PatchstackMedium 5.3
• Nov 18, 2024Popup by Supsystic: Deserialization of Untrusted DataCVE-2024-52434 · affects up to 1.10.29 · reported by Patchstack1.1% oddsCritical 9.1
• May 17, 2024Popup by Supsystic: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-46197 · affects up to 1.10.19 · reported by Patchstack1.5% oddsMedium 5.3
• Apr 15, 2024Popup by Supsystic: Missing AuthorizationCVE-2024-31421 · affects up to 1.10.27 · reported by PatchstackMedium 4.3
• Jul 17, 2023Popup by Supsystic: Has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into ObjectCVE-2023-3186 · fixed in 1.10.19 · reported by WPScan1.5% oddsCritical 9.8
• May 9, 2022Popup by Supsystic: Does not have any authentication and authorisation in an AJAX actionCVE-2022-0424 · fixed in 1.10.9 · reported by WPScan2.8% oddsMedium 5.3
• May 5, 2021Popup by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24275 · fixed in 1.10.5 · reported by WPScan18% oddsMedium 6.1
• Aug 20, 2019The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.CVE-2016-10915 · fixed in 1.7.9 · reported by MITREHigh 8.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.