Skip to content
Sign in
4.3 Medium

CVE-2022-2405 The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action,…

Description

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

Affected products and versions

Product Affected versions Fixed in
WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter 1.2 earliest → < 1.2.9 1.2.9

Other CVEs of WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter

The 2 CVEs of WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter →
CVE-2022-2404 The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in… 6.1 Medium
Track this CVE