Read the docs

OptinMonster

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

OptinMonster records in CISA KEV

No OptinMonster vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Optinmonster 5 records MEDIUM

Records

5 records

TI-2023-00732 CVE-2023-0772 · GHSA-w5vw-x33c-r8g6

Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure

Priority MEDIUM 62

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00778 Published 2023-03-13 Fixed in 2.12.2
TI-2021-16708 CVE-2021-39341 · GHSA-whcc-jgf3-q7pm

OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

Priority MEDIUM 61

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/R…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.21929 Published 2021-11-01 No fix listed CWE-285
TI-2021-16695 CVE-2021-39325 · GHSA-q4c3-5fjh-5v6h

OptinMonster <= 2.6.0 Reflected Cross-Site Scripting

Priority LOW 29

The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00905 Published 2021-09-20 No fix listed CWE-79
Open these records in search →