Live › vulnerability › CVE-2026-115223
Go to dashboardThe Smart Popup by Supsystic WordPress plugin before 2.0.2 fails to strip template delimiters from popup text, because a decoding step runs after the filter and rebuilds them. An authenticated administrator can inject template expressions that run on the server and read PHP constants such as database credentials and authentication keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Sites running the Smart Popup by Supsystic WordPress plugin older than . Exploitation requires an administrator account, so the risk sits with sites where admin access is shared or can be obtained by others. Sites without this plugin can skip it.
2.0.2No product ranges from the sources yet.
2.0.2 is affected.wp plugin list --name=*popup* if WP-CLI is available.2.0.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-115223")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.