Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: Wow-Company Component: Modal Window Clear all filters
TI-2025-00760 CVE-2025-0897 · GHSA-w56m-wcpr-36rf

Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode

Priority LOW 28

The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00308 Published 2025-02-20 No fix listed CWE-79
TI-2024-28998 CVE-2024-43346 · GHSA-qgc2-f4hh-59pp

WordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wow-Company Modal Window allows Stored XSS.This issue affects Modal Window: from n/a through 6.0.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-08-18 No fix listed CWE-79
TI-2024-03237 CVE-2024-3472 · GHSA-wwjm-ww5x-84hm

Modal Window < 5.3.10 - Modal Deletion via CSRF

Priority LOW 26

The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack

CVSS 3.1MEDIUM 5.9 Local No auth No interaction EPSS 0.00204 Published 2024-05-02 Fixed in 5.3.10 CWE-352
TI-2024-02283 CVE-2024-2457 · GHSA-hj8p-jr2c-9cmj

Cross-site scripting in Wow-Company Modal Window – create popup modal window

Priority LOW 28

The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 5.3.8 due to insufficient input sanitizat…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0034 Published 2024-04-09 No fix listed CWE-79
TI-2023-04749 CVE-2023-5161 · GHSA-q973-4w77-q8w6

Modal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping on user supplied attrib…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00655 Published 2023-09-26 No fix listed CWE-79
TI-2021-07329 CVE-2021-25051 · GHSA-8g5c-c435-6rx7

Modal Window < 5.2.2 - RFI leading to RCE via CSRF

Priority LOW 39

The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00798 Published 2022-01-10 Fixed in 5.2.2 CWE-352