WordPress Popup Box plugin <= 4.3.6 - Missing Authorization to Information Exposure vulnerability

Missing Authorization to Information Exposure vulnerability discovered by Krzysztof Zając in WordPress Plugin Popup box versions = 4.3.6...

Newsletter Popup <= 1.2 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Newsletter Popup Add New" 2...

Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF

Description The plugin does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack Make an admin open a link where is a valid user:...

WordPress Popup box Plugin <= 4.3.6 is vulnerable to Broken Access Control

Software Popup box Type Plugin Vulnerable versions = 4.3.6 Fixed in 4.3.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3897 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a8831019ec23 Credits Krzysztof Zając Required privilege...

Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF

Description The plugin does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack PoC Make an admin open a link where is a valid user: http://example.com/wp-admin/admin.php?page=wpnewslettershowlocalrecord=delete=...

Newsletter Popup <= 1.2 - List Deletion via CSRF

Description The plugin does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack Make an admin open a URL where is a valid id: http://example.com4/wp-admin/admin.php?page=wpnewslettershowitems&action=trash&id=...

Newsletter Popup <= 1.2 - Unauthenticated Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins 1. Make sure there is a newsletter configured with the setting "Email Service Save to local database" 2. When not logged in, use a...

Popup Box – Best WordPress Popup Plugin < 4.3.7 - Missing Authorization to Information Exposure

Description The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ayspbcreateauthor AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to...

Popup Anything < 2.8.1 - Missing Authorization

Description The Popup Anything – Popup for opt-ins and Lead Generation Conversions plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the popupaocrenderpopuppreview function in all versions up to, and including, 2.8.0. This makes it possible for...

CVE-2024-32601

Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Popup Anything.This issue affects Popup Anything: from n/a through 2.8...

CVE-2024-32601 WordPress Popup Anything plugin <= 2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Popup Anything.This issue affects Popup Anything: from n/a through 2.8...

CVE-2024-32601

CVE-2024-32601 is a Missing Authorization vulnerability affecting WP OnlineSupport/Popup Anything until v2.8. The CVSS v3.1 base score is 5.3 (Network, Low attack complexity, No privileges required, No user interaction; Confidentiality impact Low). Exploitation status is not observed in the provi...

CVE-2024-32601 WordPress Popup Anything plugin <= 2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Popup Anything.This issue affects Popup Anything: from n/a through 2.8...

WordPress Plugin Popup Anything 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

WordPress Popup Anything plugin <= 2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Popup Anything versions = 2.8...

WordPress Popup Anything Plugin <= 2.8 is vulnerable to Broken Access Control

Software Popup Anything Type Plugin Vulnerable versions = 2.8 Fixed in 2.8.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32601 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 740d15898275 Credits Steven Julian Required privilege...

CVE-2024-31421

Missing Authorization vulnerability in Supsystic Popup by Supsystic.This issue affects Popup by Supsystic: from n/a through 1.10.27...

CVE-2024-31421

Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.This issue affects Popup by Supsystic: from n/a through = 1.10.27...

CVE-2024-31421 WordPress Popup by Supsystic plugin <= 1.10.27 - Broken Access Control vulnerability

Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic.This issue affects Popup by Supsystic: from n/a through = 1.10.27...

CVE-2024-31421

CVE-2024-31421 concerns a Missing Authorization vulnerability in Supsystic Popup by Supsystic, affecting Popup by Supsystic versions up to 1.10.27 (no details on exposed actions). Root cause identified in connected Red Hat advisory as Missing Authorization. Public information in the provided docu...