CVE-2024-9428

Summary

CVE-2024-9428 is a newly disclosed vulnerability affecting the Popup Builder WordPress plugin before version 4.3.5. This issue allows high privilege users, such as admins, to inject malicious scripts into the plugin's settings, enabling Stored Cross-Site Scripting attacks. This vulnerability persists even when the unfiltered_html capability is disabled in multisite configurations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.