CVE-2017-2284

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Popup Maker	Popup Maker	prior to version 1.6.5

References

https://jvn.jp/en/jp/JVN92921024/index.htmlThird Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1697216/#file3Patch, Third Party Advisory
https://wordpress.org/plugins/popup-maker/#developersProduct, Third Party Advisory
https://wpvulndb.com/vulnerabilities/8878
https://jvn.jp/en/jp/JVN92921024/index.htmlThird Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1697216/#file3Patch, Third Party Advisory
https://wordpress.org/plugins/popup-maker/#developersProduct, Third Party Advisory
https://wpvulndb.com/vulnerabilities/8878

Timeline

Published: Aug 2, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-22856.1Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script o CVE-2017-22867.8Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S3 CVE-2017-22877.8Untrusted search path vulnerability in NFC Port Software remover Ver.1.3.0.1 and earlier allows an attacker to gain privileges via a Trojan CVE-2017-22887.8Untrusted search path vulnerability in LhaForge Ver.1.6.5 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an uns CVE-2017-22897.8Untrusted search path vulnerability in Installer of Qua station connection tool for Windows version 1.00.03 allows an attacker to gain privi CVE-2017-22908.8On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will CVE-2017-22929.0Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code e CVE-2017-22934.9Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to ins CVE-2017-22947.5Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in CVE-2017-22958.2Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified CVE-2017-22966.5In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group na CVE-2017-22977.5Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens.