CVE-2020-37243CWE-89sql-injection

CVE-2020-37243

High · published May 16, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-16T20:16Z
References (4)
https://downloads.wordpress.org/plugin/pricing-table-by-supsystic.1.8.7.zip · [email protected]https://supsystic.com/ · [email protected]https://www.exploit-db.com/exploits/49533 · [email protected]https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-pricing-table-sql-injection-xss · [email protected]
EPSS history
Timeline
  • 16 MAY 15:25Z
    WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS
    cvelistv5