Non notée
CVE-2022-0479 The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter…
Description
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Popup Builder – Create highly converting, mobile friendly marketing popups. 4.1 | premières → < 4.1.1 | 4.1.1 |
Autres CVE de Popup Builder – Create highly converting, mobile friendly marketing popups.
Les 4 CVE de Popup Builder – Create highly converting, mobile friendly marketing popups. →
CVE-2022-1894
The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high…
Non notée
CVE-2022-0228
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters…
Non notée
CVE-2021-25082
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it…
Non notée