High severity · published May 16, 2026
CVE-2020-37243
WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PT
Pricing Table · Supsystic
1.8.6; 1.8.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37243
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37243
downloads.wordpress.org
https://downloads.wordpress.org/plugin/pricing-table-by-supsystic.1.8.7.zip
supsystic.com
https://supsystic.com/
www.exploit-db.com
https://www.exploit-db.com/exploits/49533
www.vulncheck.com
https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-pricing-table-sql-injection-xss