CVE-2024-5561

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-5561
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5561.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-5561
Published
2024-09-09T06:00:01.342Z
Modified
2026-07-15T01:49:12.380305588Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Popup Maker < 1.19.1 - Admin+ Stored XSS
Details

The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5561.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "1.19.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "1.19.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "WPScan"
}
References

Affected packages

Git / github.com/popupmaker/popup-maker

Affected ranges

Type
GIT
Repo
https://github.com/popupmaker/popup-maker
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0377dc4ac7e651220da89b2fce6c3b3f9ad0893f
Database specific 
{
    "cpe": "cpe:2.3:a:code-atlantic:popup_maker:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.19.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v1.*
v1.1.8
v1.2.1
v1.3
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.4.11
v1.4.13
v1.4.14
v1.4.15
v1.4.16
v1.4.17
v1.4.18
v1.4.19
v1.4.2
v1.4.20
v1.4.21
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.6.4
v1.6.5
v1.6.6
v1.7.12
v1.7.14
v1.7.15
v1.7.17
v1.7.19
v1.7.21
v1.7.22
v1.7.26
v1.7.27
v1.7.28
v1.7.29
v1.7.30
v1.7.7
v1.7.9
v1.8.0
v1.8.0-beta.1
v1.8.1
v1.8.11
v1.8.13
v1.8.14
v1.8.3
v1.8.5
v1.8.7
v1.8.8
v1.8.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5561.json"