Popup Anything <= 2.0.3 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability

Contributor

Published
2021-10-24

The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

CVE

https://www.cve.org/CVERecord?id=CVE-2021-24883

CVSS

Score:6.9

Severity:Medium

Version: 2.0.3

There is a patch available in v2.0.4 and we strongly recommend you update to this version as soon as possible.