CVE-2023-6000 Popup Builder < 4.2.3 - Unauthenticated Stored XSS

2024-01-0114:18:56

WPScan

www.cve.org

cve-2023-6000

popup builder

wordpress

unauthenticated stored xss

EPSS

0.001

Percentile

17.0%

JSON

The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Popup Builder",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "4.2.3"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]