Threat Entry Updated 2025-01-29

CVE-2023-1905 - Wp Popups Plugin

The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003

PLUGIN Wp Popups

CVE-2023-1905

MEDIUM CVSS 5.4 2023-05-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2023-24003 - Wp Popups Plugin

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin

PLUGIN Wp Popups

CVE-2023-24003

MEDIUM CVSS 6.5 2023-04-06

Risk Score

Open Full Technical Breakdown