CVE-2024-3236 Easy Notify Lite < 1.1.33 - Contributor+ Stored XSS

2024-06-1706:00:01

WPScan

github.com

cve-2024-3236; easy notify lite; stored xss; popup builder wordpress plugin; 1.1.33; contributor+.

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Popup Builder",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.1.33",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]