Lucene search

K

9 matches found

CVE
CVE
added 2024/02/12 4:15 p.m.75 views

CVE-2023-6591

The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

4.8CVSS5.8AI score0.00195EPSS
CVE
CVE
added 2023/11/20 7:15 p.m.35 views

CVE-2023-5343

The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

4.8CVSS4.8AI score0.00086EPSS
Web
CVE
CVE
added 2023/12/04 10:15 p.m.35 views

CVE-2023-5809

The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

4.8CVSS4.7AI score0.00198EPSS
CVE
CVE
added 2023/10/31 2:15 p.m.34 views

CVE-2023-4390

The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

4.8CVSS4.9AI score0.00171EPSS
CVE
CVE
added 2021/08/02 11:15 a.m.33 views

CVE-2021-24460

The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

8.8CVSS9.1AI score0.00532EPSS
Web
CVE
CVE
added 2021/08/02 11:15 a.m.32 views

CVE-2021-24458

The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

8.8CVSS9.1AI score0.00532EPSS
Web
CVE
CVE
added 2023/12/04 10:15 p.m.28 views

CVE-2023-5874

The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

4.8CVSS4.7AI score0.00198EPSS
CVE
CVE
added 2023/06/21 2:15 p.m.27 views

CVE-2023-27414

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin

7.1CVSS6AI score0.00083EPSS
CVE
CVE
added 2025/05/15 8:16 p.m.16 views

CVE-2024-9599

The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

5.4CVSS5.7AI score0.00052EPSS