Arscode Ninja Popups Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arscode Ninja Popups arscode-ninja-popups allows Stored XSS.This issue affects Ninja Popups: from n/a through <= 4.7.8.

Affected:

up to 4.7.8

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-63059 on NVD →

The Ninja Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

6.4

Affected:

up to 4.7.8

Fix:

No patched version reported

Disclosed:

Oct 29, 2025

CVE-2025-63059 on NVD →

[en] Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions.

Affected:

up to 4.7.8

Fixed in:

4.7.8

Disclosed:

Aug 10, 2023

CVE-2022-27861 on NVD →

The Ninja Popups plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 4.7.7. This is due to insufficient validation on a redirect url. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performin...

CVSS:

4.3

Affected:

up to 4.7.7

Fixed in:

4.7.8

Disclosed:

Jul 18, 2023

CVE-2022-27861 on NVD →