← Back

Timersys

timersys

4 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Wp Popups
wp_popups
3 CVEs
Popups
popups
1 CVE

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-1905
1Timersys
1Wp Popups
Jun 17, 2026
May 8, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users...Show more
The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003Show less
CVE-2023-24003
1Timersys
1Wp Popups
Jun 17, 2026
Apr 6, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin <= 2.1.4.8 versions.
CVE-2022-4716
1Timersys
1Wp Popups
Jun 17, 2026
Jan 23, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform St...Show more
The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.Show less
CVE-2022-2305
1Timersys
1Popups
Jun 17, 2026
Aug 1, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilte...Show more
The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)Show less