3520 matches found
CVE-2023-4390 Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup...
CVE-2023-4390
Affected product: WordPress Popup box plugin (versions before 3.7.2). Vulnerability: admin+ stored cross-site scripting due to insufficient sanitization/escaping of certain Popup fields, enabling arbitrary script injection even when unfiltered_html is disallowed (notably in multisite setups). Imp...
WordPress Plugin Popup box Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress Popup box Plugin < 3.7.2 is vulnerable to Cross Site Scripting (XSS)
Software Popup box Type Plugin Vulnerable versions 3.7.2 Fixed in 3.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4390 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 4da53333beaa Credits Prasad Borvankar Required...
WordPress Slick Popup Plugin <= 1.7.14 is vulnerable to Cross Site Scripting (XSS)
Software Slick Popup Type Plugin Vulnerable versions = 1.7.14 Fixed in 1.7.15 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-46824 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6bfc0d7608aa Credits Huynh Tien Si Required privilege...
The vulnerability in the admin-post.php script of the Popup Builder administration panel of the WordPress content management system allows a hacker to execute arbitrary SQL code.
The vulnerability in the admin-post.php script of the Popup Builder administration panel of the WordPress content management system is related to the lack of protection for the SQL query structure when processing the orderby and order parameters. Exploiting this vulnerability allows an attacker t...
Popup Box < 3.7.9 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed. 1 Create a new popup via /wp-admin/admin.php?page=ays-pb&action=add 2 Set its "Custom...
WordPress WP Post Popup Plugin <= 3.7.3 is vulnerable to Cross Site Scripting (XSS)
Software WP Post Popup Type Plugin Vulnerable versions = 3.7.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4808 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3ee14d9df6d2 Credits Abhijith A Required privileg...
Popup Box < 3.7.9 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed. PoC 1 Create a new popup via /wp-admin/admin.php?page=ays-pb=add 2 Set its "Custom content...
WP Post Popup <= 3.7.3 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Enter the following payload in the Close...
PT-2023-21082 · Idweb · Idweb
Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns missing authentication in the StudentPopupDetails ContactDetails method, allowing unauthenticated attackers to extract sensitive student data. Recommendations: For...
PT-2023-20736 · Idweb · Idweb
Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to missing authentication in the StudentPopupDetails Timetable method, allowing unauthenticated attackers to extract sensitive student data. Recommendations: For...
IDAttend IDWeb Access Control Error Vulnerability
IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in IDAttend IDWeb version 3.1.052 and prior versions, which stems from a lack of authentication in the StudentPopupDetailsStudentDetails method...
IDAttend IDWeb Access Control Error Vulnerability
IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in IDAttend IDWeb version 3.1.052 and prior versions, which stems from a lack of authentication in the StudentPopupDetailsContactDetails method...
Exploit for Path Traversal in Supsystic Popup
CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing...
BIT-2023-5561
The Popup Builder WordPress plugin through 4.1.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2023-29896 · Supsystic · Popup
Name of the Vulnerable Software and Affected Versions: Popup by Supsystic versions 1.10.19 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This allows Relative Path Traversal, which ca...
CVE-2023-45381
In the module "Creative Popup" creativepopup up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via cpdownloadpopup...
