What the vulnerability does
01Description
A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an unknown part of the file admin/class-woo-popup-admin.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.3.0 is able to address this issue. The patch is named 7c76ac78f3e16015991b612ff4fa616af4ce9292. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222327.
Explanation of Vulnerability in Simple Terms
02Summary
The woo-popup plugin contains a stored cross-site scripting (XSS) vulnerability in versions 1.2.0 and earlier. An authenticated user with low privileges can inject malicious scripts that execute in other users' browsers when they view affected content. The vulnerability requires user interaction to trigger but can compromise site security and user data.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view the affected page.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other visitors; may lead to credential theft, malware distribution, or unauthorized actions on your site.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with low-level user privileges and the victim must visit the page containing the injected script.
Key dates
06Disclosure timeline
March 6, 2023
CVE published
March 5, 2025
Record updated
