CVE-2019-25744: WordPress Popup Builder 3.49 Persistent Cross-Site Scripting
WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the posttitle parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads in the posttitle field that execute when pages or posts display popup selections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
WordPress Popup Builder 3.49from your environment.Uninstall the WordPress Popup Builder plugin if it is not required by the site to eliminate the vulnerable component.
- Configuration
Deactivate the WordPress Popup Builder plugin in WordPress (Plugins page) to prevent popup selections from rendering until a safe update is available.
WordPress Popup Builder enabled = false - Compensating control
Apply WAF rules or input filtering to block POST requests containing script payloads targeting post.php (specifically malicious post_title values); restrict access to post.php and content-editing endpoints to trusted/authenticated administrator IPs where possible.
- Operational
Inspect posts, pages, and popup configuration entries for injected script content in post_title fields, remove any malicious code, and clean any affected pages that render popups.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25744?
CVE-2019-25744 has a medium severity rating of 6.4.
How do I fix CVE-2019-25744?
To mitigate CVE-2019-25744, update the WordPress Popup Builder plugin to a version that addresses the persistent cross-site scripting vulnerability.
What type of vulnerability is CVE-2019-25744?
CVE-2019-25744 is identified as a persistent cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2019-25744?
Authenticated users of WordPress Popup Builder 3.49 can be affected by CVE-2019-25744 if they can submit crafted POST requests.
What can attackers do with CVE-2019-25744?
Attackers can exploit CVE-2019-25744 to inject malicious scripts into the post_title parameter, leading to potential unauthorized script execution.