CVE-2023-5809: Popup box < 3.8.6 - Admin+ Stored XSS in Categories
Published Dec 4, 2023
·Updated
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
1 affected component
ays-pro Popup Box Wordpress<3.8.6
Event History
Dec 4, 2023
CVE Published
09:29 PM
Data Sourced
09:29 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the Popup Box plugin?
The vulnerability ID for the Popup Box plugin is CVE-2023-5809.
2
What is the severity of CVE-2023-5809?
The severity of CVE-2023-5809 is medium with a severity value of 4.8.
3
What is the affected software for CVE-2023-5809?
The affected software for CVE-2023-5809 is the Popup Box WordPress plugin version up to 3.8.6.
4
What is the description of CVE-2023-5809?
CVE-2023-5809 is a stored cross-site scripting (XSS) vulnerability in the Popup Box plugin before version 3.8.6 in WordPress.
5
How can an admin mitigate the risk of CVE-2023-5809?
To mitigate the risk of CVE-2023-5809, admins should update the Popup Box plugin to version 3.8.6 or later.