CVE-2023-0924 Zyrex Popup <= 1.0 - Admin+ Arbitrary File Upload

The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user such as an Administrator to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install...

CVE-2023-0924 Zyrex Popup <= 1.0 - Admin+ Arbitrary File Upload

The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user such as an Administrator to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install...

CVE-2023-0924

CVE-2023-0924 concerns the Zyrex Popup WordPress plugin (versions

Newsletter Popup <= 1.2 - Unauthenticated Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks 1. Create a Newsletter popup any will do and publish it. 2. Use an incognito window and open the website involved, then run the following code in th...

PT-2023-16620 · WordPress · Zyrex Popup

Name of the Vulnerable Software and Affected Versions: ZYREX POPUP WordPress plugin versions 1.0 and earlier Description: The issue allows a high privileged user, such as an Administrator, to upload arbitrary files when creating a popup, even when modifying the file system is disallowed, such as ...

Newsletter Popup <= 1.2 - Record Deletion via CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wpnewslettershowlocalrecord page is not protected with a nonce...

WordPress plugin ZYREX POPUP 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

April 25, 2023—KB5025297 (OS Build 19045.2913) Preview

None None...

CVE-2022-47598

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Plugins Pro WP Super Popup plugin = 1.1.2 versions...

CVE-2022-47598 WordPress WP Super Popup Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Plugins Pro WP Super Popup plugin = 1.1.2 versions...

CVE-2022-47598 WordPress WP Super Popup Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Plugins Pro WP Super Popup plugin = 1.1.2 versions...

CVE-2022-47598

This CVE concerns the WordPress WP Super Popup plugin (versions ≤ 1.1.2). The vulnerability is a Stored Cross-Site Scripting (XSS) that requires admin+ privileges to exploit. Multiple sources (NVD, Red Hat, WPVulnDB, PatchStack) describe the impact as XSS affecting settings handling, with exploit...

PT-2023-15421 · WordPress · Wp Super Popup

Name of the Vulnerable Software and Affected Versions: WP Super Popup plugin versions = 1.1.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the WP Super Popup plugin. This vulnerability requires authentication with admin+ privileges...

WordPress plugin WP Super Popup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Uji Popup Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Uji Popup Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23641 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 59d88f6966b4 Credits István Márton Required privileg...

WordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)

Software Email Subscription Popup Type Plugin Vulnerable versions = 1.2.16 Fixed in 1.2.17 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30489 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1c9d307f1d96 Credits...

WordPress Simple Popup Images Plugin <= 1.8.6 is vulnerable to Cross Site Scripting (XSS)

Software Simple Popup Images Type Plugin Vulnerable versions = 1.8.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24406 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 103d1c0b467f Credits yuyudhn Required...

Adobe Acrobat Reader DC Popup Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...

PT-2023-20908 · Prestashop · Prestashop Advancedpopupcreator

Name of the Vulnerable Software and Affected Versions: Prestashop advancedpopupcreator versions 1.1.21 through 1.1.24 Description: The issue is related to a SQL injection vulnerability. It affects the component AdvancedPopup::getPopups. Recommendations: For versions 1.1.21 through 1.1.24, conside...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in PrestaShop advancedpopupcreator versions v1.1.21...