CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Muneeb's Custom Popup Builder plugin <= 1.3.1 at WordPress.
Explanation of Vulnerability in Simple Terms
The Custom Popup Builder WordPress plugin through version 1.3.1 does not properly restrict access to certain administrative functions. A logged-in user with low privileges can perform actions intended for higher-privilege users by manipulating requests, potentially affecting other users' data or site configuration. User interaction is required to trigger the vulnerability.
What an attacker can do
A low-privilege logged-in user can perform administrative actions and view or modify data they shouldn't access.
Potential impact on your site
Unauthorized users may modify plugin settings, access sensitive data, or affect other users' popup configurations.
Conditions required to exploit
Attacker must have a low-privilege WordPress account and trick a user into clicking a malicious link or visiting a crafted page.
Key dates
External resources
Related vulnerabilities
