Lucene search
WPScanCVELIST:CVE-2022-4125HistoryDec 19, 2022 - 1:41 p.m.
CVE-2022-4125 Popup Manager <= 1.6.6 - Unauthenticated Stored XSS
2022-12-1913:41:50
WPScan
www.cve.org
2
wordpress
plugin
unauthenticated
xss
sanitisation
csrf
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well
CNA Affected
[
{
"vendor": "Unknown",
"product": "Popup Manager",
"collectionURL": "https://wordpress.org/plugins",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThanOrEqual": "1.6.6"
}
],
"defaultStatus": "affected"
}
]Related
nvd
nvd
CVE-2022-4125
2022-12-19 14:15:12
prion
prion
Cross site request forgery (csrf)
2022-12-19 14:15:00
wpvulndb
wpvulndb
Popup Manager <= 1.6.6 - Unauthenticated Stored XSS
2022-11-28 00:00:00
cve
cve
CVE-2022-4125
2022-12-19 14:15:12
wpexploit
wpexploit
Popup Manager <= 1.6.6 - Unauthenticated Stored XSS
2022-11-28 00:00:00