Popup Box Pro < 7.9.0 - Admin+ Stored XSS

2024-01-2200:00:00

John Jefferson Li

wpscan.com

popup box pro

vulnerability

stored xss

admin privilege

unfiltered_html

settings

cross-site scripting

AI Score

5.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

PoC

Create/edit a new popup and add the following payload in the Custom Content: Save, and notice the alert box appearing when visiting the blog