CVEvulnerability
CVE-2023-6000
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-01-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
Affected configurations
• sygnoos popup builder (< 4.2.3)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8 Exploit, Third Party Advisory
- https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8 Exploit, Third Party Advisory