Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: OptinMonster Component: Optinmonster Clear all filters
TI-2023-00732 CVE-2023-0772 · GHSA-w5vw-x33c-r8g6

Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure

Priority MEDIUM 62

The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00778 Published 2023-03-13 Fixed in 2.12.2
TI-2021-16708 CVE-2021-39341 · GHSA-whcc-jgf3-q7pm

OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

Priority MEDIUM 61

The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/R…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.21929 Published 2021-11-01 No fix listed CWE-285
TI-2021-16695 CVE-2021-39325 · GHSA-q4c3-5fjh-5v6h

OptinMonster <= 2.6.0 Reflected Cross-Site Scripting

Priority LOW 29

The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00905 Published 2021-09-20 No fix listed CWE-79