CVE-2023-5874

Summary

CVE-2023-5874 is a vulnerability affecting the Popup box WordPress plugin before version 3.8.6. This issue permits high privilege users, including admins, to execute Stored Cross-Site Scripting attacks. The plugin fails to sanitize and escape certain settings, allowing malicious scripts to be stored and subsequently injected into webpages. Even in multisite setups where the unfiltered_html capability is disallowed, this vulnerability can still pose a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.