CVE-2023-6591 Popup Box Pro < 20.9.0 - Admin+ Stored XSS

2024-02-1216:06:00

WPScan

www.cve.org

cve-2023-6591

popup box pro

wordpress

xss

vulnerability

unfiltered_html disallowed

admin

AI Score

5.8

Confidence

High

EPSS

Percentile

9.0%

JSON

The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Popup Box",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "20.8.7",
        "lessThan": "20.9.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]