Description
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Magnific Popup | ≤ 1.0 | — |
References
- https://wpscan.com/vulnerability/30f408dd-4b9a-438c-8dc4-c6daafe237fe/ exploit vdb-entry technical-description