WordPress Plugin Vulnerabilities

Popup by Supsystic < 1.10.30 - Admin+ Remote Code Execution

Description

The plugin is vulnerable to Remote Code Execution. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

Affects Plugins

Plugin icon
popup-by-supsystic
Fixed in 1.10.30

References

CVE
CVE-2024-52434
URL
https://patchstack.com/database/wordpress/plugin/popup-by-supsystic/vulnerability/wordpress-popup-by-supsystic-plugin-1-10-29-remote-code-execution-rce-vulnerability

Miscellaneous

Original Researcher
Hakiduck
Verified
No
WPVDB ID
1ea9fb9b-9465-428c-a69c-95758b49e965

Timeline

Publicly Published
2024-11-15 (about 1 year ago)
Added
2024-12-02 (about 1 year ago)
Last Updated
2024-12-02 (about 1 year ago)

Other

Published
Title
Published
2016-05-26
Title
Jetpack 2.0-4.0.2 - Shortcode Stored Cross-Site Scripting (XSS)
Published
2014-04-29
Title
Contact Bank 2.0.19 - Multiple Unspecified Issues
Published
2023-05-30
Title
Blog-in-Blog <= 1.1.1 - Editor+ Local File Inclusion via Shortcode
Published
2014-08-01
Title
mb.miniAudioPlayer 1.4.2 - TinyMCE Popup Unspecified Issue
Published
2022-03-11
Title
WordPress < 5.9.2 / Gutenberg < 12.7.2 - Prototype Pollution via Gutenberg’s wordpress/url package