CVE-2022-0641

CVE-2022-0641: Popup Like box < 3.6.1 - Reflected Cross-Site Scripting

Vendor Unknown

Product Popup Like box – Page Plugin

Weakness CWE-79 · XSS

Published March 28, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

Key dates

02Disclosure timeline

March 28, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0641 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-32504 WordPress Silvasoft boekhouden plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2025-65095 Lookyloo is vulnerable due to improper user input sanitization CVE-2025-22286 WordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.0.21 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-2323 Cross-site Scripting (XSS) - Stored in pimcore/pimcore CVE-2025-34313 IPFire < v2.29 Stored XSS via User Quota Rule URL Filter