CVE-2022-3690

Опубликовано: 21 нояб. 2022

Источник: nvd

CVSS3: 4.8

CVSS3: 5.5

EPSS Низкий

Описание

The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins

Ссылки

https://wpscan.com/vulnerability/725f6ae4-7ec5-4d7c-9533-c9b61b59cc2b
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/725f6ae4-7ec5-4d7c-9533-c9b61b59cc2b
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:code-atlantic:popup_maker:*:*:*:*:*:wordpress:*:*

Версия до 1.16.11 (исключая)

EPSS

Процентиль: 62%

0.00435

Низкий

4.8 Medium

CVSS3

5.5 Medium

CVSS3

Дефекты

Связанные уязвимости

GHSA-grjj-rwj8-4mx3

CVSS3: 4.8

github

около 3 лет назад

The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

EPSS

Процентиль: 62%

0.00435

Низкий

4.8 Medium

CVSS3

5.5 Medium

CVSS3