CVE-2021-24152

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownPopup Builder – Responsive WordPress Pop up – Subscription & Newsletter>= 3.74, < 3.74

References

Timeline

Published
Apr 5, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-241535.4A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filtCVE-2021-241544.9The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, alloCVE-2021-241557.2The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP CVE-2021-241565.4Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScCVE-2021-241575.4Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that aCVE-2021-241586.5Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As parCVE-2021-241598.8Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject maliciouCVE-2021-24164.9Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported versioCVE-2021-241608.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files thCVE-2021-241618.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploadiCVE-2021-241628.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importiCVE-2021-241638.8The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protect
CVE-2021-24152: Medium severity, CVSS 6.1 | Vulnix