CVE-2024-3580

The Popup4Phone WordPress plugin (versions 1.3.2 and earlier ) contains a Stored Cross-Site Scripting (XSS) vulnerability due to a failure to properly sanitize and escape certain settings. This flaw allows users with elevated privileges, such as Editors , to inject and execute arbitrary JavaScrip...

CVE-2024-3580 Popup4Phone <= 1.3.2 - Editor+ Stored XSS

The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3580 Popup4Phone <= 1.3.2 - Editor+ Stored XSS

The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Popup4Phone Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Popup4Phone Type Plugin Vulnerable versions = 1.3.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3580 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9736f59d6bae Credits Bob Matyas Required privilege...