Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Ivanweb Clear all filters
TI-2024-03337 CVE-2024-3580 · GHSA-vpwx-x2qh-rw8j

Popup4Phone <= 1.3.2 - Editor+ Stored XSS

Priority LOW 27

The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilte…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00389 Published 2024-05-17 No fix listed CWE-79
TI-2024-03029 CVE-2024-3231 · GHSA-xq5f-88w9-ffw2

Popup4Phone <= 1.3.2 - Unauthenticated Stored XSS

Priority LOW 28

The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00678 Published 2024-05-17 No fix listed CWE-79