What the vulnerability does
01Description
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting directory traversal sequences. Additionally, the plugin fails to sanitize input fields in publication settings, allowing stored cross-site scripting attacks through script injection in parameters like Area Width and Publication Width that execute when publications are viewed or edited.
Explanation of Vulnerability in Simple Terms
02Summary
Digital Publications versions 1.6.9 and later contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. An attacker with network access can craft input that executes arbitrary JavaScript in users' browsers without requiring authentication or user interaction. This can lead to session hijacking, credential theft, or malware distribution.
What an attacker can do
03Attacker Capabilities
Inject and execute malicious JavaScript code in users' browsers to steal sessions, credentials, or redirect users.
Potential impact on your site
04Site Impact
Visitors' browsers can be compromised; attackers may steal admin sessions, inject malware, or deface content.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 16, 2026
CVE published
May 18, 2026
Record updated
