Onclick Show Popup Vulnerabilities

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Onclick show popup plugin <= 8.1 versions.

Affected:

up to 8.2

Fix:

No patched version reported

Disclosed:

Oct 2, 2023

CVE-2023-44228 on NVD →

The Onclick Show Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbi...

CVSS:

4.4

Affected:

up to 8.1

Fix:

No patched version reported

Disclosed:

Sep 28, 2023

CVE-2023-44228 on NVD →

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 6.6

Fixed in:

6.6

Disclosed:

May 14, 2015

Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

CVSS:

6.1

Affected:

up to 6.6

Fixed in:

6.6

Disclosed:

Aug 1, 2014

CVE-2013-6837 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

Affected:

up to 6.6

Fixed in:

6.6

Disclosed:

Dec 19, 2013

CVE-2013-6837 on NVD →