The Supsystic Digital Publications plugin suffers from a directory traversal vulnerability in the Folder input field that permits attackers to read files outside the web root. In addition, the plugin does not properly sanitize input for configuration options such as Area Width and Publication Width, enabling stored cross‑site scripting attacks when publications are displayed or edited. The weakness is identified as CWE‑79 and can compromise confidentiality, integrity, and availability of affected sites.

Supsystic Digital Publications plugin version 1.6.9 used in WordPress installations is the only version reported to be affected.

With a CVSS score of 8.7 this flaw is considered high severity. The EPSS score is not available, but the existence of public exploits indicates that the vulnerability can be leveraged in real‑world attacks. The flaw is not yet listed in CISA’s KEV catalog. The likely attack vector is remote web access through the WordPress administration interface, allowing an attacker to supply malicious parameters and gain arbitrary file access or execute malicious scripts within the site context. If unmitigated, the risk is significant for any WordPress site hosting the vulnerable plugin.