CVE-2022-3690: Popup Maker < 1.16.11 - Contributor+ Stored Cross Site Scripting
Published Nov 21, 2022
·Updated
The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins
Affected Software
1 affected component
Code-atlantic Popup Maker Wordpress<1.16.11
Event History
Nov 21, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-3690.
2
What is the severity of CVE-2022-3690?
The severity of CVE-2022-3690 is medium with a CVSS score of 4.8.
3
How does the Popup Maker WordPress plugin before 1.16.11 allow Stored Cross-Site Scripting attacks?
The plugin does not properly sanitise and escape some of its Popup options, allowing users with low-level roles to perform Stored Cross-Site Scripting attacks.
4
Who can exploit this vulnerability?
Users with roles as low as Contributor can exploit this vulnerability.
5
Is there a fix available for CVE-2022-3690?
Yes, updating the Popup Maker WordPress plugin to version 1.16.11 or higher fixes the vulnerability.