CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the post_title parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads in the post_title field that execute when pages or posts display popup selections.
Explanation of Vulnerability in Simple Terms
Popup Builder versions 3.49 and later contain a cross-site scripting (XSS) vulnerability. An attacker with low-level site access can inject malicious scripts that execute in other users' browsers when they interact with affected popup elements. The vulnerability requires user interaction to trigger. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of victims.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they interact with popups.
Potential impact on your site
Attackers with low-level accounts can compromise other users' sessions or steal their data via popup interactions.
Conditions required to exploit
Low-level site access (e.g., contributor or subscriber role) and victim must click or interact with a malicious popup.
Key dates
External resources
Related vulnerabilities
