PT-2022-13173 · Supsystic · The Popup By Supsystic

Name of the Vulnerable Software and Affected Versions: The Popup by Supsystic WordPress plugin versions prior to 1.10.9 Description: The issue concerns a lack of authentication and authorization in an AJAX action, allowing unauthenticated attackers to call it and obtain the email addresses of...

Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure

The plugin does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Length: 104 Accept: application/json, text/javascript, /; q=0.01...

Login/Signup Popup < 2.2 - Reflected Cross-Site Scripting

The plugin does not escape its tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=xoo-el-fields="...

WordPress ConvertPlus Plugin Input Validation Error Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ConvertPlus is a popup plugin used in it. A security vulnerability exists in WordPress ConvertPlus plugin versions prior to 3.4.5. No...

WordPress slick-popup plugin trust management issue vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. slick-popup is a window popup plugin used in it. A trust management issue vulnerability exists in WordPress slick-popup plugin version...

CVE-2019-15867

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

Hardcoded credentials

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

Wordpress Popup By Supsystic plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A cross-site request forgery vulnerability exists in the Wordpress Popup By Supsystic plugin. Attackers can tric...

WordPress Plugin Popup by Supsystic 1.7.6 - Cross-Site Request Forgery

!-- Source: https://sumofpwn.nl/advisory/2016/popupbysupsysticwordpresspluginvulnerabletocrosssiterequestforgery.html Abstract A Cross-site Request Forgery vulnerablity exists in the Popup by Supsystic WordPress Plugin. This vulnerablity allows attackers to add and modify scripting code that will...

WordPress plugin Timed Popup (wp-timed-popup) cross-site request forgery vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability in WordPress plugin Timed Popup wp-timed-popup versions prior to 1.3 allows remote...

WordPress Timed Popup Plugin <= 1.3 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...

Timed Popup <= 1.3 - CSRF & Stored XSS

The wp-timed-popup WordPress plugin was affected by a CSRF & Stored XSS security vulnerability...