Bbs E Popup Vulnerabilities

The BBS e-Popup plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bbse_popup_admin_action_proc() function called via admin_action in versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to modify popup settings.

CVSS:

5.3

Affected:

up to 2.4.5

Fix:

No patched version reported

Disclosed:

Jun 23, 2023

CVE-2023-36504 on NVD →

The BBS e-Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri...

CVSS:

6.1

Affected:

up to 2.4.5

Fix:

No patched version reported

Disclosed:

May 30, 2023

CVE-2023-34174 on NVD →