CVE-2024-3641

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

6.1MEDIUM

EPSS

0.4%

top 38.55%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Newsletter Popup Mndpsingh287 Newsletter Popup

Timeline

PublishedMay 16

Description

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/newsletter_popup1.2

▶NVDmndpsingh287/newsletter_popup1.2

🔴Vulnerability Details

GHSA

GHSA-m3m5-w4hq-w7x6: The Newsletter Popup WordPress plugin through 1↗2024-05-16

▶

CVEList

Newsletter Popup <= 1.2 - Unauthenticated Stored XSS↗2024-05-16

▶