CVE-2023-32966 WordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Request Forgery (CSRF) leading to Stored XSS
Attackers can exploit CSRF to inject stored XSS payloads, allowing script execution in victim browsers via the Jazz Popups plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-32966?
CVE-2023-32966 is a medium-severity vulnerability in CRUDLab Jazz Popups, published on 7 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7.
Weakness: CWE-352
Which versions are affected by CVE-2023-32966?
It affects 1 product.
Products include Crudlab Jazz Popups.
How do I fix CVE-2023-32966?
No fix has been published for CVE-2023-32966 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-32966 being exploited?
There is no known exploitation of CVE-2023-32966 in the wild and no public exploit code.
Other vulnerabilities in CRUDLab Jazz Popups
Sources
Also known as GHSA-wfqw-8765-478x.