Description (CNA)
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Popup Manager | affected 0 through 1.6.6 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.