customer_engagement_system vulnerabilities
CVEs whose affected-version data names the customer_engagement_system package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-115225Medium· 5.8Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup
The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to a…
▾ SunlitEPSS 0.24%via CVEORG
CVE-2026-115224Medium· 4.1Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement wi…
▾ SunlitEPSS 0.24%via CVEORG