WordPress Plugin Vulnerabilities

WP Popup Builder < 1.2.9 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
wp-popup-builder
Fixed in 1.2.9

References

CVE
CVE-2022-2404

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
https://kazet.cc/
Submitter twitter
kazet1234
Verified
Yes
WPVDB ID
0d889dde-b9d5-46cf-87d3-4f8a85cf9b98

Timeline

Publicly Published
2022-09-05 (about 3 years ago)
Added
2022-09-05 (about 3 years ago)
Last Updated
2022-09-30 (about 3 years ago)

Other

Published
Title
Published
2016-04-12
Title
Easy Contact Form Builder <= 1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2024-10-24
Title
Selection Lite < 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2014-10-09
Title
Contact Form DB 2.8.13 - 2 x Cross-Site Scripting (XSS)
Published
2024-06-06
Title
GiveWP – Donation Plugin and Fundraising Platform < 3.12.1 - Reflected Cross-Site Scripting
Published
2024-03-25
Title
Buddypress Moderation <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting