Detections
Analytics
Popup Builder Plugin for WordPress < 3.64.1 Multiple Vulnerabilities
medium Web App Scanning Plugin ID 98985
Language:
Synopsis
Popup Builder Plugin for WordPress < 3.64.1 Multiple VulnerabilitiesDescription
The WordPress Popup Builder Plugin installed on the remote host is affected by an unauthenticated stored Cross-Site Scripting (XSS) and authenticated settings modification, configuration disclosure, and user data export vulnerabilities.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Popup Builder Plugin for WordPress 3.64.1 or latest.See Also
Plugin Details
Severity: Medium
ID: 98985
Type: remote
Family: Component Vulnerability
Published: 3/16/2020
Updated: 3/14/2023
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2020-10195
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS Score Source: CVE-2020-10195
Vulnerability Information
CPE: cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/13/2020
Vulnerability Publication Date: 3/13/2020
Reference Information
CVE: CVE-2020-10195, CVE-2020-10196
OWASP: 2010-A2, 2010-A6, 2010-A8, 2013-A3, 2013-A5, 2013-A7, 2013-A9, 2017-A5, 2017-A6, 2017-A7, 2017-A9, 2021-A1, 2021-A3, 2021-A6
WASC: Cross-Site Scripting, Information Leakage, Insufficient Authorization
CAPEC: 116, 13, 169, 19, 209, 22, 224, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 441, 472, 478, 479, 497, 502, 503, 508, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 573, 574, 575, 576, 577, 578, 588, 59, 591, 592, 60, 616, 63, 643, 646, 651, 79, 85
DISA STIG: APSC-DV-000460, APSC-DV-002490, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-15
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-14.2.1, 4.0.2-5.3.3, 4.0.2-8.3.4