CVE-2022-1104

MEDIUM

Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-1104 has a selected CVSS score of 4.8 (medium); EIP currently links 1 catalogued exploit.

Description

The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

Popup Maker – Popup for opt-ins, lead gen, & more

CVE List1.16.5 to < 1.16.5affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)ExploitDB exploitby Roel van BeurdenNot analyzed1 file
ExploitDB
PoC details

References

2