Simple Image Popup Vulnerabilities

The Simple Image Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to injec...

CVSS:

4.4

Affected:

up to 2.4.0

Fixed in:

2.5.3

Disclosed:

May 2, 2024

CVE-2024-4433 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr Digital Simple Image Popup allows Stored XSS.This issue affects Simple Image Popup: from n/a through 2.4.0.

Affected:

up to 2.5.3

Fixed in:

2.5.3

Disclosed:

May 2, 2024

CVE-2024-4433 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <= 1.3.6 versions.

Affected:

up to 2.0.0

Fixed in:

2.0.0

Disclosed:

Mar 29, 2023

CVE-2022-47610 on NVD →

The Simple Image Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via popup settings in versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject a...

CVSS:

4.4

Affected:

up to 1.3.6

Fixed in:

2.0.0

Disclosed:

Jan 27, 2023

CVE-2022-47610 on NVD →