Digital Publications by Supsystic < 1.7.4 - Admin+ Stored Cross-Site Scripting
Description
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <1.7.4
- Range: 1.7.4
Patches
Vulnerability mechanics
Root cause
"Missing sanitization and escaping of plugin settings allows stored cross-site scripting."
Attack vector
An attacker with admin-level privileges can inject arbitrary JavaScript into the plugin's settings fields. Because the plugin does not sanitize or escape these settings [ref_id=1], the injected script is stored and executed when any user (including other administrators) visits the settings page. This allows stored cross-site scripting even when the WordPress `unfiltered_html` capability is disallowed [ref_id=1].
Affected code
The advisory does not specify the exact file or function name within the Digital Publications by Supsystic plugin that is vulnerable. The plugin's settings page is the affected code path, as the plugin fails to sanitize and escape its settings before output [ref_id=1].
What the fix does
The advisory states the vulnerability is fixed in version 1.7.4 of the plugin [ref_id=1]. No patch diff is provided in the bundle, but the fix presumably adds proper sanitization and escaping of the plugin's settings before they are output, preventing stored XSS injection by high-privilege users.
Preconditions
- authAttacker must have admin-level privileges on the WordPress site
- configThe Digital Publications by Supsystic plugin must be installed and active
Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- wpscan.com/vulnerability/0917b964-f347-487e-b8d7-c4f09c290fe5mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.