Supsystic has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 5. The median CVSS is 6.8 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-79 (3). Most affected products: ultimate-maps-by-supsystic (2), contact-form-by-supsystic (1), gallery-by-supsystic (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- ultimate-maps-by-supsystic 2
- contact-form-by-supsystic 1
- gallery-by-supsystic 1
- google-maps-easy 1
- popup-by-supsystic 1
Worst active — by depth score
CVE-2026-102398High· 7.1Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.39CVE-2026-102396High· 7.1Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.39CVE-2026-102395High· 7.1Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.39CVE-2026-102397Medium· 6.5Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.36CVE-2026-102399Medium· 5.4Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.30
Supsystic vulnerabilities
CVEs affecting Supsystic, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-115595Medium· 5.3WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1…
CVE-2026-102397Medium· 6.5Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
CVE-2026-102398High· 7.1Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
CVE-2026-102395High· 7.1Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
CVE-2026-102399Medium· 5.4Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
CVE-2026-102396High· 7.1Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.