CVE-2019-17574

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.redyops.com/wordpress-plugin-popup-maker/Exploit, Third Party Advisory
https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.mdRelease Notes
https://wpvulndb.com/vulnerabilities/9907Third Party Advisory
http://blog.redyops.com/wordpress-plugin-popup-maker/Exploit, Third Party Advisory
https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.mdRelease Notes
https://wpvulndb.com/vulnerabilities/9907Third Party Advisory

Timeline

Published: Oct 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-175757.2A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user w CVE-2019-175765.4An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via th CVE-2019-175775.4An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the CVE-2019-175785.4An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the CVE-2019-175796.1SonarSource SonarQube before 7.8 has XSS in project links on account/projects.CVE-2019-17584.3A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an unauthenticated, adjacent attac CVE-2019-175809.8tonyy dormsystem through 1.3 allows SQL Injection in admin.php.CVE-2019-175816.1tonyy dormsystem through 1.3 allows DOM XSS.CVE-2019-175829.8A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempti CVE-2019-175837.5idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonst CVE-2019-175847.5The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. All firmware versions CVE-2019-17595.3A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow