CVE-2022-1750

The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin level capabilities and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue mostly affects sites where unfiltered_html has been disabled for administrators and on multi-site installations where unfiltered_html is disabled for administrators.
Configurations

Configuration 1 (hide)

cpe:2.3:a:sticky_popup_project:sticky_popup:*:*:*:*:*:wordpress:*:*

History

04 Nov 2023, 02:04

Type Values Removed Values Added
References (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5262d8-d9cd-4bd9-a95e-f60782095173?source=cve - (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5262d8-d9cd-4bd9-a95e-f60782095173?source=cve - Third Party Advisory
CWE CWE-79

20 Oct 2023, 16:15

Type Values Removed Values Added
CWE CWE-79
Summary The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin level capabilities and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue mostly affects sites where unfiltered_html has been disabled for administrators and on multi-site installations where unfiltered_html is disabled for administrators. The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin level capabilities and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue mostly affects sites where unfiltered_html has been disabled for administrators and on multi-site installations where unfiltered_html is disabled for administrators.
References
  • (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5262d8-d9cd-4bd9-a95e-f60782095173?source=cve -

21 Jun 2022, 20:51

Type Values Removed Values Added
First Time Sticky Popup Project
Sticky Popup Project sticky Popup
CVSS v2 : unknown
v3 : unknown
v2 : 3.5
v3 : 4.8
CPE cpe:2.3:a:sticky_popup_project:sticky_popup:*:*:*:*:*:wordpress:*:*
References (MISC) https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1750 - (MISC) https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1750 - Third Party Advisory

13 Jun 2022, 14:24

Type Values Removed Values Added
New CVE

Information

Published : 2022-06-13 14:15

Updated : 2023-12-10 14:22


NVD link : CVE-2022-1750

Mitre link : CVE-2022-1750

CVE.ORG link : CVE-2022-1750


JSON object : View

Products Affected

sticky_popup_project

  • sticky_popup
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')