CVE-2024-7083

The Email Encoder WordPress plugin, in versions before 2.3.4 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape specific plugin settings. This flaw allows high-privilege users, such as administrators, to perform Stored XSS attacks,...

CVE-2023-6294 popup-builder < 4.2.6 - Admin+ SSRF & File Read

The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations...