CVE-2026-115224
Customer Engagement System: Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
Unknown Customer Engagement System
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 2.0.2Customer Engagement SystemCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
Text from CVE List
Affected versions 1
- Customer Engagement Systemaffected: all versions before 2.0.2CVE List