vendor:
Popup Maker
by:
Roel van Beurden
8.8
CVSS
HIGH
Persistent Cross-Site Scripting (Authenticated)
79
CWE
Product Name: Popup Maker
Affected Version From: <1.16.5
Affected Version To: <1.16.5
Patch Exists: YES
Related CWE:
CPE: a:wppopupmaker:popup_maker
Platforms Tested: WordPress 5.9 on Ubuntu 20.04
2022
WordPress Plugin Popup Maker <1.16.5 – Persistent Cross-Site Scripting (Authenticated)
WordPress Plugin Popup Maker <1.16.5 does not sanitise and escape some of its popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Mitigation:
Upgrade to version 1.16.5 or later.
