Slick Popup: Contact Form 7 Popup Plugin <= 1.7.14 - Authenticated (Admin+) Stored Cross-Site Scripting
medium
The Slick Popup: Contact Form 7 Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the main heading parameter in all versions up to 1.7.15 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
- CVSS:
- 4.4
- Affected:
- up to 1.7.15
- Fixed in:
- 1.7.15
- Disclosed:
- Oct 29, 2023
CVE-2023-46824 on NVD →
Slick Popup <= 1.7.1 - Privilege Escalation
high
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.
- CVSS:
- 8.8
- Affected:
- up to 1.7.2
- Fixed in:
- 1.7.2
- Disclosed:
- May 28, 2019
CVE-2019-15867 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database