Vulnerability · Published May 16, 2026 · Assigned by VulnCheck

CVE-2020-37245WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS

High 7.5

In plain English

A high-severity cross-site scripting in Digital Publications from Supsystic. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting directory traversal sequences. Additionally, the plugin fails to sanitize input fields in publication settings, allowing stored cross-site scripting attacks through script injection in parameters like Area Width and Publication Width that execute when publications are viewed or edited.

Affected products (as reported)

Vendor	Product	Versions
Supsystic	Digital Publications	1.6.9

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ExploitDB-49542 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS third-party-advisory