Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter 1.2.9 Clear all filters
TI-2022-02220 CVE-2022-2405 · GHSA-wmh8-mcwp-x84h

WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

Priority MEDIUM 53

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00319 Published 2022-09-26 Fixed in 1.2.9 CWE-352
TI-2022-02219 CVE-2022-2404 · GHSA-j2hx-526f-q8h2

WP Popup Builder < 1.2.9 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00626 Published 2022-09-26 Fixed in 1.2.9 CWE-79