plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/optinmonster/tags/2.16.0/OMAPI/Elementor/Widget.php CVE-2024-4045
MEDIUM
Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Record summary
CVE-2024-4045 has a selected CVSS score of 6.4 (medium).
Description
The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘campaign_id’ parameter in versions up to, and including, 2.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 26, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead GenerationBrowse smub / Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead GenerationDefault status: unaffected | CVE List | Through 2.16.1 | affected |
References
3plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3087905 wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/b4dfeb49-38d3-495d-af96-d67a29b339fa?source=cve