CVE-2019-25744

EIP tracks 1 public exploit for CVE-2019-25744. PoCs published by Unk9vvN.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in WordPress Popup Builder 3.49 by injecting a malicious script into the popup title, which executes when the popup is rendered in the 'Add Post' or 'Add Page' sections.

WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the post_title parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads in the post_title field that execute when pages or posts display popup selections.