Search criteria
2 vulnerabilities found for Popup Maker – Popup for opt-ins, lead gen, & more by Unknown
CVE-2022-1104 (GCVE-0-2022-1104)
Vulnerability from cvelistv5 – Published: 2022-05-09 16:50 – Updated: 2024-08-02 23:55
VLAI?
Title
Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting
Summary
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Severity ?
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Popup Maker – Popup for opt-ins, lead gen, & more |
Affected:
1.16.5 , < 1.16.5
(custom)
|
Credits
Roel van Beurden
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:55:23.360Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Popup Maker \u2013 Popup for opt-ins, lead gen, \u0026 more",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.16.5",
"status": "affected",
"version": "1.16.5",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Roel van Beurden"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-09T16:50:46",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Popup Maker \u003c 1.16.5 - Admin+ Stored Cross-Site Scripting",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-1104",
"STATE": "PUBLIC",
"TITLE": "Popup Maker \u003c 1.16.5 - Admin+ Stored Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Popup Maker \u2013 Popup for opt-ins, lead gen, \u0026 more",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.16.5",
"version_value": "1.16.5"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Roel van Beurden"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-1104",
"datePublished": "2022-05-09T16:50:46",
"dateReserved": "2022-03-26T00:00:00",
"dateUpdated": "2024-08-02T23:55:23.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1104 (GCVE-0-2022-1104)
Vulnerability from nvd – Published: 2022-05-09 16:50 – Updated: 2024-08-02 23:55
VLAI?
Title
Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting
Summary
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Severity ?
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Popup Maker – Popup for opt-ins, lead gen, & more |
Affected:
1.16.5 , < 1.16.5
(custom)
|
Credits
Roel van Beurden
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:55:23.360Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Popup Maker \u2013 Popup for opt-ins, lead gen, \u0026 more",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.16.5",
"status": "affected",
"version": "1.16.5",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Roel van Beurden"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-09T16:50:46",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Popup Maker \u003c 1.16.5 - Admin+ Stored Cross-Site Scripting",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-1104",
"STATE": "PUBLIC",
"TITLE": "Popup Maker \u003c 1.16.5 - Admin+ Stored Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Popup Maker \u2013 Popup for opt-ins, lead gen, \u0026 more",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.16.5",
"version_value": "1.16.5"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Roel van Beurden"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-1104",
"datePublished": "2022-05-09T16:50:46",
"dateReserved": "2022-03-26T00:00:00",
"dateUpdated": "2024-08-02T23:55:23.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}