Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation

Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2026; all 14 are fixed as of October 2026. Their average CVSS score is 6.6, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 6 high. 2026 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (21%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 14 issues recorded for Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (2) reported by Asim Alshaya. Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891024.01.2015Today07.09.20168.8Popup by Supsystic < 1.7.9 - Cross-Site Request Forgery CVSS 8.8 · 07.09.201619.04.20216.1Popup by Supsystic <= 1.10.4 - Reflected Cross-Site Scripting CVSS 6.1 · 19.04.202118.04.20225.3Popup by Supsystic <= 1.10.8 - Sensitive Information Disclosure CVSS 5.3 · 18.04.202223.06.20237.1Popup by Supsystic <= 1.10.18 - Prototype Pollution CVSS 7.1 · 23.06.202311.08.20236.3Popup by Supsystic <= 1.10.19 - Cross-Site Request Forgery CVSS 6.3 · 11.08.202318.10.20234.3Popup by Supsystic <= 1.10.19 - Missing Authorization to Sensitive Information Exposure CVSS 4.3 · 18.10.202310.04.20244.3Popup by Supsystic <= 1.10.27 - Missing Authorization CVSS 4.3 · 10.04.202415.11.20249.1Popup by Supsystic <= 1.10.29 - Authenticated (Admin+) Remote Code Execution CVSS 9.1 · 15.11.202404.08.20268.8Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator CVSS 8.8 · 04.08.202611.08.20267.2Smart Popup by Supsystic <= 1.11.2 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 11.08.202618.08.20265.3Smart Popup by Supsystic <= 1.13.0 - Missing Authorization CVSS 5.3 · 18.08.20268.1Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection CVSS 8.1 · 18.08.202630.09.20267.2Smart Popup by Supsystic <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 30.09.202609.10.20264.9Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter CVSS 4.9 · 09.10.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

14

Get automatic notifications for all Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.1CVE-2024-52434

Popup by Supsystic <= 1.10.29 - Authenticated (Admin+) Remote Code Execution

Read the full analysis

Vulnerability Records

14 records
2026-10-09 17:27CVE-2026-104023
4.9
Medium
Wordfence PRISMYes
2026-09-30 09:57CVE-2026-102398
7.2
High
neurotxYes
2026-08-18 00:00CVE-2026-73381
5.3
Medium
Asim AlshayaYes
2026-08-18 00:00CVE-2026-73380
8.1
High
Asim AlshayaYes
2026-08-11 00:00CVE-2026-27537
7.2
High
hhhaiYes
2026-08-04 16:04CVE-2026-18322
8.8
High
darooYes
2024-11-15 00:00CVE-2024-52434
9.1
Critical
HakiduckYes
2024-04-10 00:00CVE-2024-31421
4.3
Medium
Steven JulianYes
2023-10-18 00:00CVE-2023-46197
4.3
Medium
Rafshanzani SuhadaYes
2023-08-11 00:00CVE-2023-39997
6.3
Medium
Rafshanzani SuhadaYes
Showing 1–10 of 14 reports
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation banner
Latestv2.0.2

Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation

supsystic

Author

supsystic

4.5(340)
90/100
Last Updated
2026-10-22 (6d ago)
Active Installs
9,000+
Downloads
1,688,329
Requires WP
5.9+
Requires PHP
7.3+
Tested up to
WP 7.1.3
Created
2015-01-24 (12y ago)

Customer Engagement System (CES) by Supsystic turns visitors into contacts and contacts into customers. A popup builder, a form builder, a CRM and email marketing automation share one contact base inside your WordPress, so an exit-intent popup can capture an email, the form tags the contact, and the right follow-up email goes out on its own. No Zapier, no syncing between services, no per-contact fees. Popups, forms and contacts are unlimited, and your contacts stay in your own WordPress database. Try it in your browser: open a live demo in WordPress Playground – no install, no account. From visitor to customer in five steps Capture – a popup with an offer appears at the right moment: on exit intent, after a scroll or delay, or on a click. Collect – the form inside the popup saves the visitor as a contact in your CRM. Organize – tags, custom fields and an engagement score show who is ready to buy. Follow up – a tag starts an email automation: a welcome email, a reminder, an offer. Sell – every order is credited to the email, popup or form that brought it in. Each step writes to the same contact, so your sales funnel builds itself and you can see where every customer came from. Four modules, one contact base Popup – modals, slide-ins, bars and full-screen welcome mats with 10+ triggers and 10+ targeting rules. Forms – contact, lead, newsletter, quote, login and signup forms with conditional logic and spam protection. CRM – contacts, tags, custom fields and a timeline of everything each contact did on your site. Email Campaigns & Automations – newsletters, welcome series and follow-ups started by tags, with open, click and revenue tracking. Every module writes to the same contact. A popup view, a form submit, an email click and a WooCommerce order all end up on one record. Pick a goal – CES builds the rest You don’t have to learn four modules first. Open Plays, choose an outcome and answer a few plain questions. CES creates the popup, the form, the contact tags and the emails for it, and you switch it on. Get more enquiries Build an email list Follow up a quote Re-engage past customers Welcome series, discount offers, review requests and exit-intent rescue Everything a play creates stays editable in the full editors. 200+ templates for popups, forms and emails Pick a template, change the words and colours, and go live. Popup templates arrive fully set up: animated, with their own form, matching emails, triggers and targeting. Black Friday, Cyber Monday, Christmas, New Year, Halloween, Valentine’s Day and other seasonal sales Spin-to-win wheels, scratch cards, mystery boxes and advent calendars Exit-intent offers, cart recovery, free shipping bars and countdown timers Newsletter sign-ups, lead magnets, webinars and ebooks Contact, quote, booking and callback forms Restaurants, hotels, travel, real estate, beauty, fitness and luxury brands Welcome, thank-you, follow-up and newsletter emails One-click colour palettes restyle the background, text, form and buttons together. Popup builder Centre modals, corner and side slide-ins, top and bottom bars and full-screen welcome mats Triggers: page load with delay, click on any button or element, scroll, exit intent, bottom of page, inactivity, after WooCommerce checkout, AdBlock detected and number of pages visited Targeting: pages, posts, categories, post types, devices, languages, schedule, frequency, logged-in state, user roles, referrers, URL rules and countries Audience rules from the CRM: show a popup only to new visitors, known contacts, contacts with a tag or contacts in a list Multi-step popups, quizzes, yes/no flows and countdown timers Visual editor with a live preview: click an element to select it, double-click text to edit it in place Stats per popup: views, unique views, CTR, submits, bounces, time and UTM source Form builder Contact, lead, newsletter, quote, booking, feedback and survey forms WordPress login, signup and password reset forms styled like the rest of your site 30+ field types, from text, email, phone and dropdowns to dates, ratings, ranges, file uploads, address search and WooCommerce products Conditional logic to show, hide or require fields based on earlier answers Built-in spam protection with honeypot and CAPTCHA, plus double opt-in Admin notifications and branded auto-reply emails Tags added on submit that can start an automation Embed with a block or shortcode, or place the form inside a popup WordPress CRM Unlimited contacts in your own WordPress database, with no per-contact pricing Tags, custom fields and saved lists for segmentation Activity timeline per contact: popups seen, forms submitted, emails opened and clicked, automations and orders Hot, warm and cold engagement score based on real opens, clicks and submits Import from CSV, WordPress users and WooCommerce, with automatic import of new users and orders Email replies collected over IMAP and shown on the contact as a chat Export everything to CSV at any time Email marketing and automation Automations started by a tag from a popup, form, import or order: welcome series, lead nurturing, quote follow-ups, post-purchase and win-back emails Delays in minutes, hours or days, allowed sending hours, conditions and tag actions on open, click or unsubscribe Newsletters and one-off campaigns to tags, lists or field segments, sent now or scheduled Visual email editor with live preview, reusable branded templates and placeholders such as the contact’s first name Open, click, unsubscribe and bounce tracking per email and per contact Revenue attribution that credits each sale to the email, popup, form or UTM source behind it Send through PHP mail or your SMTP server with IMAP bounce handling, or connect Microsoft 365, Google Workspace, Zoho, Fastmail, SendGrid, Mailgun, Brevo, Postmark, SMTP2GO, Resend or Amazon SES Sending-domain check for SPF and DMARC Works with WooCommerce Exit-intent coupons, free shipping bars and popups after checkout WooCommerce customers and orders imported into the CRM, guest orders included Total spent, order count and average order value on every contact Product, category and attribute fields in forms, product blocks in emails Win-back and post-purchase automations based on real orders Why one system instead of five plugins No Zapier, no webhooks. The popup, form, CRM and email tool share one database and react to each other instantly. No per-contact fees. 500 or 50,000 contacts cost the same. Your data stays yours. Contacts, campaigns and statistics live in your WordPress database. Nothing is sent to Supsystic. One plugin to update. Fewer integrations to break, one place to look when something needs a change. Made for WooCommerce stores Bloggers, publishers and newsletters Agencies and freelancers who build client sites Courses, memberships and communities B2B and service businesses that live on enquiries Restaurants, hotels, travel and local businesses CES PRO PRO switches on the advanced options in all four modules at once: Country targeting and the full set of advanced popup triggers 20+ more field types, input masks, regex validation, file and multi-file uploads Email verification before a contact is created Branching automations with conditions and unlimited steps Direct connections to 10+ mail providers 120+ premium animated popup, form, email templates and extra colour palettes Custom JavaScript per popup and per form Premium support Learn more Official plugin page Pro features Pricing FAQ External services Customer Engagement System connects to the services below only for the features that use them. Google Fonts – only when a popup or form uses a Google font. The visitor’s browser loads the font from fonts.googleapis.com. Google Fonts privacy FAQ. Forms with Google reCAPTCHA switched on send the visitor’s CAPTCHA response to Google to verify the submission (privacy policy, terms).

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C