Read the docs

Wow-Company

Records61All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high23CVSS 7.0–8.9

Exploited now

Wow-Company records in CISA KEV

No Wow-Company vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Modal Window 7 records LOW Counter Box 6 records MEDIUM Button Generator 5 records MEDIUM Wp Coder 5 records MEDIUM Herd Effects 4 records MEDIUM Bubble Menu 3 records MEDIUM Float Menu 3 records MEDIUM Side Menu Lite 3 records HIGH

Records

7 records in Modal Window · all components

TI-2021-07329 CVE-2021-25051 · GHSA-8g5c-c435-6rx7

Modal Window < 5.2.2 - RFI leading to RCE via CSRF

Priority LOW 39

The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00798 Published 2022-01-10 Fixed in 5.2.2 CWE-352
TI-2023-04749 CVE-2023-5161 · GHSA-q973-4w77-q8w6

Modal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping on user supplied attrib…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00655 Published 2023-09-26 No fix listed CWE-79
TI-2025-00760 CVE-2025-0897 · GHSA-w56m-wcpr-36rf

Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode

Priority LOW 28

The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00308 Published 2025-02-20 No fix listed CWE-79
TI-2024-28998 CVE-2024-43346 · GHSA-qgc2-f4hh-59pp

WordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wow-Company Modal Window allows Stored XSS.This issue affects Modal Window: from n/a through 6.0.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-08-18 No fix listed CWE-79
TI-2024-02283 CVE-2024-2457 · GHSA-hj8p-jr2c-9cmj

Cross-site scripting in Wow-Company Modal Window – create popup modal window

Priority LOW 28

The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 5.3.8 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0034 Published 2024-04-09 No fix listed CWE-79
TI-2024-03237 CVE-2024-3472 · GHSA-wwjm-ww5x-84hm

Modal Window < 5.3.10 - Modal Deletion via CSRF

Priority LOW 26

The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack

CVSS 3.1MEDIUM 5.9 Local No auth No interaction EPSS 0.00204 Published 2024-05-02 Fixed in 5.3.10 CWE-352
Open these records in search →