CVE-2023-3226

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-322606.5Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenTeCVE-2023-322616.5A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with OCVE-2023-322626.5A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with ICVE-2023-322635.7A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability could be exploited to rCVE-2023-322645.8CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upload arbitrary code anCVE-2023-322656.5A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in EnterpriCVE-2023-322665.3Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerabilCVE-2023-322678.8A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Management Center. The vulnerability could be remotely explCVE-2023-322687.2Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy adminisCVE-2023-322696.7An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowCVE-2023-32275.7Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.CVE-2023-322707.8Access of memory location after end of buffer issue exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 fil
CVE-2023-3226: Medium severity, CVSS 4.8 | Vulnix