Description
WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the post_title parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads in the post_title field that execute when pages or posts display popup selections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Popup-Builder | Popup Builder | 3.49 | — |
References
- ExploitDB-47518 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: WordPress Popup Builder 3.49 Persistent Cross-Site Scripting third-party-advisory