WordPress Newsletter Popup plugin <= 1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Newsletter Popup versions = 1.2...

CVE-2024-3644

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3642

The CVE-2024-3642 entry concerns the WordPress plugin Newsletter Popup (versions up to 1.2). The core issue is a missing CSRF check when deleting a subscriber, enabling an attacker to coerce a logged-in admin into performing deletion via CSRF. Impact is administrative action without authenticatio...