The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
References
| Link | Resource |
|---|---|
| https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/ | Exploit Third Party Advisory |
| https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8 | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8 | Exploit Third Party Advisory |
Configurations
History
08 Jan 2024, 15:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sygnoos
Sygnoos popup Builder |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CWE | CWE-79 | |
| References | () https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/ - Exploit, Third Party Advisory | |
| References | () https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:* |
01 Jan 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-01 15:15
Updated : 2025-06-18 15:15
NVD link : CVE-2023-6000
Mitre link : CVE-2023-6000
JSON object : View
Products Affected
sygnoos
- popup_builder
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')