CVE-2024-9599: Popup Box < 4.7.8 - Admin+ Stored XSS
The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9599?
The severity of CVE-2024-9599 is considered high due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-9599?
To fix CVE-2024-9599, update the Popup Box WordPress plugin to version 4.7.8 or later.
Who is affected by CVE-2024-9599?
CVE-2024-9599 affects WordPress sites using the Popup Box plugin versions before 4.7.8, particularly those with high privilege users.
What type of vulnerability is CVE-2024-9599?
CVE-2024-9599 is a Stored Cross-Site Scripting (XSS) vulnerability.
Can CVE-2024-9599 be exploited in a multisite setup?
Yes, CVE-2024-9599 can be exploited in a multisite setup even when the unfiltered_html capability is disallowed.