CVE-2022-4125

The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well

Score

CVSS 3.1 4.3 Medium

Status

Modified - contact@wpscan.com

Published

2022-12-19

Last modified

2024-08-03

Weaknesses

CWE-352

Affected products

• Popup Manager (Popup Manager Project)
• Popup Manager (Unknown)

References

• https://wpscan.com/vulnerability/7862084a-2821-4ef1-8d01-c9c8b3f28b05