WordPress Popup Builder plugin <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS vulnerability

🗓️ 03 Jun 2024 01:47:25Reported by Tim CoenType

patchstack

patchstack🔗 patchstack.com👁 1 Views

Authenticated stored cross site scripting in Popup Builder plugin up to 4.2.7 via JavaScript.

Reporter	Title	Published	Views	Family All 11
IBM Security Bulletins	Security Bulletin: WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager is vulnerable to a denial of service. (CVE-2024-25026)	13 May 202405:27	–	ibm
CVE	CVE-2024-2506	1 Jun 202406:51	–	cve
Cvelist	CVE-2024-2506 Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS	1 Jun 202406:51	–	cvelist
EUVD	EUVD-2024-27455	3 Oct 202520:07	–	euvd
NVD	CVE-2024-2506	1 Jun 202407:15	–	nvd
OpenVAS	openSUSE: Security Advisory for libxml2 (SUSE-SU-2024:0613-2)	12 Jun 202400:00	–	openvas
Patchstack	WordPress Popup Builder Plugin <= 4.2.7 is vulnerable to Cross Site Scripting (XSS)	3 Jun 202400:00	–	patchstack
RedhatCVE	CVE-2024-2506	7 Jan 202609:14	–	redhatcve
Vulnrichment	CVE-2024-2506 Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS	1 Jun 202406:51	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (May 27, 2024 to June 2, 2024)	6 Jun 202415:09	–	wordfence

Vulners

Node

wordpress popup_builderRange≤4.2.7

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/popup-builder/popup-builder-427-authenticatedcontributor-stored-cross-site-scripting-via-custom-js

03 Jun 2024 01:47Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.4

EPSS0.00311

SSVC

wordpress popup builder cross site scripting custom javascript plugin vulnerability tim coen