PT-2022-19103 · Unknown · Muneeb'S Custom Popup Builder

Ngo Van + 1 · CVE-2022-28612 · Published 2022-06-15 · Updated 2023-07-21

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Muneeb's Custom Popup Builder plugin versions prior to 1.3.2

Description The issue is related to an Improper Access Control vulnerability that leads to multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities. This means that users with contributor or higher user roles can exploit this issue.

Recommendations For Muneeb's Custom Popup Builder plugin versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue.

Fix

Improper Access Control

XSS

Weakness Enumeration

CWE-284

CWE-79

Related Identifiers

CVE-2022-28612

Affected Products

Muneeb'S Custom Popup Builder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-28612 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28612 · Vendor Advisory
• https://patchstack.com/database/vulnerability/m-wp-popup/wordpress-custom-popup-builder-plugin-1-3-1-improper-access-control-vulnerability-leading-to-multiple-authenticated-stored-xss · Note
• https://wordpress.org/plugins/m-wp-popup · Note