WordPress plugin Popup Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2022-25755 · WordPress · Popup Manager

Name of the Vulnerable Software and Affected Versions: Popup Manager WordPress plugin versions 1.6.6 and earlier Description: The issue concerns a lack of authorization and CSRF checks when deleting popups. This could allow unauthenticated users to delete them. Recommendations: For Popup Manager...

WordPress plugin Popup Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2022-25765 · WordPress · Popup Manager

Name of the Vulnerable Software and Affected Versions: Popup Manager WordPress plugin versions 1.6.6 and earlier Description: The issue concerns a lack of authorization and CSRF check when creating or updating popups in the plugin. It is also missing proper sanitization and escaping, which could...

Popup Manager <= 1.6.6 - Unauthenticated Stored XSS

The plugin does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well fetch'/wp-admin/admin-ajax.php', method: 'POST', headers...

Popup Manager <= 1.6.6 - Unauthenticated Stored XSS

The plugin does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well PoC fetch'/wp-admin/admin-ajax.php', method: 'POST',...

Popup Manager <= 1.6.6 - Unauthenticated Arbitrary Popup Deletion

The plugin does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them PoC As an unauthenticated users, or via CSRF: fetch'/wp-admin/admin-ajax.php', method: 'POST', headers: new Headers 'Content-Type':...

Popup Manager <= 1.6.6 - Unauthenticated Arbitrary Popup Deletion

The plugin does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them As an unauthenticated users, or via CSRF: fetch'/wp-admin/admin-ajax.php', method: 'POST', headers: new Headers 'Content-Type': 'application/x-www-form-urlencoded', ...

Mozilla Firefox and Firefox ESR 'nsXULPopupManager::KeyDown' function memory misreference vulnerability

Mozilla Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A memory misreference vulnerability exists in the 'nsXULPopupManager::KeyDown' function in Mozilla Firefox and Firefox, which can be exploited by a remote attacker to construct a malicious WEB pa...