CVE-2024-5561

The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Score

CVSS 3.1 4.8 Medium

Status

Analyzed - contact@wpscan.com

Published

2024-09-09

Last modified

2024-09-10

Weaknesses

CWE-79

Affected products

• Popup Maker (Code-atlantic)
• Popup Maker Wp (Popup Maker)
• Popup Maker (Unknown)

References

• https://wpscan.com/vulnerability/6a87cc25-bd7d-40e3-96f9-26646cd6f736/