CVE-2023-6591

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Popup Box	>= 20.8.7, < 20.9.0

References

https://wpscan.com/vulnerability/f296de1c-b70b-4829-aba7-4afa24f64c51/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/f296de1c-b70b-4829-aba7-4afa24f64c51/Exploit, Third Party Advisory

Timeline

Published: Feb 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-65925.3The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files.CVE-2023-65939.8Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the CVE-2023-65944.8The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions CVE-2023-65955.3In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an CVE-2023-65967.5An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.CVE-2023-65977.8An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and pri CVE-2023-65984.3The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache CVE-2023-65994.3Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.CVE-2023-66005.4The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stor CVE-2023-66014.7A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers CVE-2023-66025.3A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant inp CVE-2023-66037.5A flaw was found in FFmpeg's HLS playlist parsing. This vulnerability allows a denial of service via a maliciously crafted HLS playlist that