CVE-2023-4390: Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed (for example in a multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4390?
The severity of CVE-2023-4390 is medium with a CVSS score of 4.8.
How does Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting vulnerability affect WordPress?
The Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting vulnerability allows high-privilege users to inject arbitrary web scripts in WordPress, even when the unfiltered_html capability is disallowed.
What is the affected version of the Popup box plugin?
The affected version of the Popup box plugin is version 3.7.2 and below.
How can an attacker exploit CVE-2023-4390?
An attacker can exploit CVE-2023-4390 by injecting arbitrary web scripts through the Popup fields in the vulnerable version of the Popup box plugin.
Is there a fix available for the Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting vulnerability?
Yes, upgrading to version 3.7.2 of the Popup box plugin or applying the necessary patches will fix the vulnerability.