Home

Description

Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting directory traversal sequences. Additionally, the plugin fails to sanitize input fields in publication settings, allowing stored cross-site scripting attacks through script injection in parameters like Area Width and Publication Width that execute when publications are viewed or edited.

PUBLISHED Reserved 2026-05-16 | Published 2026-05-16 | Updated 2026-05-18 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

1.6.9
affected

Credits

Erik David Martin finder

References

www.exploit-db.com/exploits/49542 (ExploitDB-49542) exploit

supsystic.com/ (Official Product Homepage) product

downloads.wordpress.org/...blications-by-supsystic.1.6.9.zip (Product Reference) product

www.vulncheck.com/...digital-publications-path-traversal-xss (VulnCheck Advisory: WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS) third-party-advisory

cve.org (CVE-2020-37245)

nvd.nist.gov (CVE-2020-37245)

Download JSON