medium4.8Public exploit code
CVE-2022-1104
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)2022-04-19 · webapps · php
Impact
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Code-Atlantic | Popup Maker | before 1.16.5 |