CVE-2023-1905

published 2023-05-08

CVE-2023-1905: The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a…

Priority P4 23 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003

Affected

1 ranges

Vendor	Product	Version range	Fixed in
timersys	wp_popups	< 2.1.5.1	2.1.5.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79