Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: WP OnlineSupport, Essential Plugin Component: Popup Anything Clear all filters
TI-2022-01956 CVE-2022-2115 · GHSA-mch4-6f94-27mh

Popup Anything < 2.1.7 - Reflected Cross-Site Scripting

Priority LOW 28

The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0067 Published 2022-07-25 Fixed in 2.1.7 CWE-79
TI-2021-07165 CVE-2021-24883 · GHSA-9fv2-2p6h-wc29

Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site Scripting

Priority LOW 26

The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00804 Published 2021-11-29 Fixed in 2.0.4 CWE-79