CVE-2022-4125

Popup Manager <= 1.6.6 - Unauthenticated Stored XSS

published December 19, 2022

CVSS
—
EPSS
0%
Percentile
21.5
In the wild
Unconfirmed
What it is

The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00300 · 21.5th percentile
Published
2022-12-19T13:41Z
EPSS history
Timeline
  • 19 DEC 13:41Z
    Popup Manager <= 1.6.6 - Unauthenticated Stored XSS
    cvelistv5