CVE-2022-3690

The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins

Score

CVSS 3.1 5.5 Medium

Status

Modified - contact@wpscan.com

Published

2022-11-21

Last modified

2025-04-29

Affected products

• Popup Maker (Code-atlantic)
• Popup Maker (Unknown)

References

• https://wpscan.com/vulnerability/725f6ae4-7ec5-4d7c-9533-c9b61b59cc2b