← Back

Popup4phone

popup4phone

Vendor: Ivanweb • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-3580
1Ivanweb
1Popup4phone
Jun 17, 2026
May 17, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilte...Show more
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)Show less
CVE-2024-3231
1Ivanweb
1Popup4phone
Jun 17, 2026
May 17, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.