WordPress Plugin Vulnerabilities

Popup Like box < 3.6.1 - Reflected Cross-Site Scripting

Description

The plugin does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

Proof of Concept

Affects Plugins

Plugin icon
ays-facebook-popup-likebox
Fixed in 3.6.1

References

CVE
CVE-2022-0641

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Ran Crane
Submitter
Ran Crane
Verified
Yes
WPVDB ID
0a9830df-5f5d-40a3-9841-40994275136f

Timeline

Publicly Published
2022-03-07 (about 3 years ago)
Added
2022-03-07 (about 3 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2024-12-20
Title
Contact Form Master <= 1.0.7 - Reflected XSS
Published
2023-09-06
Title
Carrot <= 1.1.0 - Admin+ Stored XSS
Published
2025-12-12
Title
HT Slider for Elementor < 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-20
Title
Dino Game < 1.2.0 - Contributor+ Stored XSS
Published
2021-05-10
Title
LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile