CVE-2022-4381: Popup Maker < 1.16.9 - Contributor+ Stored XSS via Subscription Form
Published Jan 2, 2023
·Updated
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Affected Software
1 affected component
Code-atlantic Popup Maker Wordpress<1.16.9
Event History
Jan 2, 2023
CVE Published
via MITRE·09:49 PM
Data Sourced
via MITRE·09:49 PM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2022-4381?
CVE-2022-4381 is a vulnerability in the Popup Maker WordPress plugin that allows users with a low role to perform Stored Cross-Site Scripting attacks.
2
How severe is CVE-2022-4381?
CVE-2022-4381 has a severity of 5.4, which is considered medium.
3
Which version of the Popup Maker WordPress plugin is affected?
The Popup Maker WordPress plugin version up to exclusive 1.16.9 is affected by CVE-2022-4381.
4
How can the vulnerability be exploited?
CVE-2022-4381 can be exploited by users with a role as low as contributor to execute Stored Cross-Site Scripting attacks.
5
Is there a fix available for CVE-2022-4381?
Yes, upgrading to version 1.16.9 or later of the Popup Maker WordPress plugin fixes the vulnerability.