CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-4961 – Poptin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
https://notcve.org/view.php?id=CVE-2023-4961
The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Poptin para WordPress es vulnerable a Cross-Site Scripting (XSS) Almacenado a través del shortcode 'poptin-form' en versiones hasta la 1.3 incluida debido a una sanitización de entrada y a un escape de salida en los atributos proporcionados por el usuario insuficientes. Esto hace posible que atacantes autenticados con permisos de nivel de colaborador y superiores inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • https://plugins.trac.wordpress.org/browser/poptin/tags/1.3/poptin.php#L659 https://plugins.trac.wordpress.org/changeset/2968210/poptin#file2 https://www.wordfence.com/threat-intel/vulnerabilities/id/778af777-4c98-45cd-9704-1bdc96054aa7?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2305 – WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-2305
The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) El plugin Popup de WordPress versiones hasta 1.9.3.8 no comprueba ni escapa de algunos de sus ajustes, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo Cross-Site Scripting cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio) The Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcode attributes in versions up to, and including, 1.9.3.8. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/ea0180cd-e018-43ea-88b9-fa8e71bf34bf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •