Prasad Borvankar

**Name of the Vulnerable Software and Affected Versions** Popup box WordPress plugin versions prior to 3.7.2 **Description** The issue allows high-privilege users, such as administrators, to inject arbitrary web scripts, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some Popup fields. **Recommendations** For versions prior to 3.7.2, update to version 3.7.2 or later to resolve the issue.