Read the docs

mndpsingh287

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

mndpsingh287 records in CISA KEV

No mndpsingh287 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Newsletter Popup 4 records HIGH Advanced Search 1 record LOW File Manager 1 record MEDIUM

Records

4 records in Newsletter Popup · all components

TI-2024-03398 CVE-2024-3643 · GHSA-hc4m-mm2c-rjg7

Newsletter Popup <= 1.2 - List Deletion via CSRF

Priority HIGH 73

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00347 Published 2024-05-16 No fix listed CWE-352
TI-2024-03396 CVE-2024-3641 · GHSA-m3m5-w4hq-w7x6

Newsletter Popup <= 1.2 - Unauthenticated Stored XSS

Priority MEDIUM 60

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00386 Published 2024-05-16 No fix listed CWE-79
TI-2024-03397 CVE-2024-3642 · GHSA-g8vg-m5vq-4hcq

Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF

Priority LOW 30

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.00254 Published 2024-05-16 No fix listed CWE-352
TI-2024-03399 CVE-2024-3644 · GHSA-9hfh-q9rg-j934

Newsletter Popup <= 1.2 - Admin+ Stored XSS

Priority LOW 22

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00372 Published 2024-05-16 No fix listed CWE-79
Open these records in search →