CVE-2022-1104 EXPLOIT
4.8
MEDIUM · CVSS 3.1 · EPSS 56.4% (pctl 99)
Patch early
A public exploit exists.
Description
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Scoring
| CVSS | 4.8 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 56.41% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2022-05-09 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| code-atlantic | popup maker |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated) | 2022-04-19 |
References
→ the Explorer · watch your stack · NVD