Skip to content
Sign in
5.4 Medium

CVE-2023-1905 The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page…

Description

The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003

Affected products and versions

Product Affected versions Fixed in
WP Popups 2.1 earliest → < 2.1.5.1 2.1.5.1

Other CVEs of WP Popups

The 2 CVEs of WP Popups →
CVE-2022-4716 The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before… 5.4 Medium
Track this CVE