CVE-2022-4125

Popup Manager <= 1.6.6 - Unauthenticated Stored XSS

The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well

Affected

Popup Manager

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 21st percentile

Published

2022-12-19

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7862084a-2821-4ef1-8d01-c9c8b3f28b05

References

• CVE Record
• NVD entry