WordPress plugin Popup Builder by OptinMonster 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation < 2.16.0 - Cross-Site Request Forgery to Notice Dismissal

Description The OptinMonster plugin is vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the validatepleaseconnectnoticedismiss function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted they can...

CVE-2024-33691

Cross-Site Request Forgery CSRF vulnerability in OptinMonster Popup Builder Team OptinMonster.This issue affects OptinMonster: from n/a through 2.15.3...

CVE-2024-33691 WordPress Popup Builder by OptinMonster plugin <= 2.15.3 - Cross Site Request Forgery (CSRF) Notice Dismissal vulnerability

Cross-Site Request Forgery CSRF vulnerability in OptinMonster Popup Builder Team OptinMonster.This issue affects OptinMonster: from n/a through 2.15.3...

CVE-2024-33691

CVE-2024-33691 is a Cross-Site Request Forgery (CSRF) vulnerability in the OptinMonster Popup Builder for WordPress (Plugin: Popup Builder by OptinMonster) tracked across multiple sources. Affected versions are listed as up to 2.15.3 (n/a through 2.15.3). The connected data describe exploitation ...

WordPress Popup Builder by OptinMonster plugin <= 2.15.3 - Cross Site Request Forgery (CSRF) Notice Dismissal vulnerability

Cross Site Request Forgery CSRF Notice Dismissal vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin OptinMonster versions = 2.15.3...

WordPress OptinMonster Plugin <= 2.15.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software OptinMonster Type Plugin Vulnerable versions = 2.15.3 Fixed in 2.16.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-33691 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 73c4aeef8fbf Credits Dhabaleshwar Das...

WordPress plugin OptinMonster 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

WordPress OptinMonster Plugin < 2.12.2 Authentication Bypass Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:optinmonster:optinmonster"; ifdescription...

CVE-2023-0772

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protecte...

CVE-2023-0772

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protecte...

Buffer overflow

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protecte...

CVE-2023-0772 Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protecte...

CVE-2023-0772

Summary (concrete details): CVE-2023-0772 affects the WordPress plugin “Popup Builder by OptinMonster” (pre-2.12.2). The root cause is the plugin not verifying that a loaded campaign via shortcodes is actually a campaign, enabling any authenticated user with subscriber privileges to retrieve cont...

CVE-2023-0772 Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protecte...

WordPress Plugin OptinMonster 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress OptinMonster Plugin < 2.12.2 is vulnerable to Broken Access Control

Software OptinMonster Type Plugin Vulnerable versions 2.12.2 Fixed in 2.12.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0772 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0628b7efbdf5 Credits Erwan LR WPScan Required privileg...

Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure

The plugin does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones. Run one of the below commands in the developer...

Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure

The plugin does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones. PoC Run one of the below commands in the...

WordPress OptinMonster Plugin < 2.6.5 API Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...