← Vulnerability feed

Vulnerability record · CVE-2023-3186 · published 17 July 2023

CVE-2023-3186: Supsystic popup vulnerability

Supsystic · Popup

The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.

9.8 CVSS 3.1 Critical EPSS 1.5% · top 27.6%
9.8CVSS 3.1 base score
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/545007fc-3173-47b1-82c4-ed3fd1247b9c ExploitThird Party Advisory
https://wpscan.com/vulnerability/545007fc-3173-47b1-82c4-ed3fd1247b9c ExploitThird Party Advisory

Track CVE-2023-3186 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-39997Supsystic popup missing authorization vulnerabilityMissing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This …EPSS 0.67%9.8CVE-2023-51353Supsystic popup missing authorization vulnerabilityMissing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Securi…EPSS 0.57%9.1CVE-2024-52434Supsystic popup code injection vulnerabilityDeserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup …EPSS 1.1%8.8CVE-2016-10915Supsystic popup cross-site request forgery vulnerabilityThe popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.EPSS 0.68%6.5CVE-2023-46197Supsystic popup path traversal vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path…EPSS 1.3%6.1CVE-2021-24275Supsystic popup cross-site scripting vulnerabilityThe Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, le…EPSS 18%5.3CVE-2022-0424Supsystic popup missing authentication for critical function vulnerabilityThe Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated …EPSS 2.9%4.3CVE-2024-31421Supsystic popup missing authorization vulnerabilityMissing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.This issue affects Popup by Supsystic: from n/a through <= 1.1…EPSS 0.37%

Source: NIST National Vulnerability Database (record CVE-2023-3186), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.