WordPress Plugin Vulnerabilities

Custom Popup Builder <= 1.3.1 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does have proper authorisation in place, and does not sanitise as well as escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
m-wp-popup
No known fix

References

CVE
CVE-2022-28612

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Ngo Van Thien
Verified
Yes
WPVDB ID
a5d185e9-e9ce-49c0-82bd-eaedf4c3751c

Timeline

Publicly Published
2022-06-14 (about 1 years ago)
Added
2022-06-16 (about 1 years ago)
Last Updated
2023-03-19 (about 1 years ago)

Other

Published
Title
Published
2023-04-06
Title
IMPress Listings <= 2.6.2 - Contributor+ Stored XSS
Published
2021-11-10
Title
WP Project Manager < 2.4.14 - Authenticated Stored Cross-Site Scripting
Published
2024-03-28
Title
WP-CRM System < 3.2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-02-15
Title
Podlove Subscribe button < 1.3.9 - Admin+ Stored XSS
Published
2014-08-01
Title
Photolio - VideoJS Cross-Site Scripting