CVE-2022-3690

Popup Maker < 1.16.11 - Contributor+ Stored Cross Site Scripting

The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins

We have discovered 36,451 live websites that are affected by CVE-2022-3690.

Test my site



Affected Software

Product  Popup Maker
Category Wordpress Plugins
Vulnerable Domains36,451 live websites (19.72% of Popup Maker install base)
Vulnerable Versions
  • from 0 before 1.16.11
Vulnerable Versions Count107 versions ( 84.92% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Nov 21, 2022
  • Updated - Aug 3, 2024

Credits

  • c3p0d4y (finder)

CVE-2022-3690 usage by Country

United States11,070 websites


Russia5,849 websites
Germany2,684 websites
France1,811 websites
Poland1,036 websites
Italy940 websites
GB889 websites
Ukraine821 websites
Spain783 websites
Australia713 websites

CVE-2022-3690 usage by TLD

.com13,544 websites
.ru4,789 websites
.org1,306 websites
.de1,103 websites
.com.au871 websites
.pl810 websites
.it799 websites
.net632 websites
.co.uk614 websites
.fr604 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-3690

Top websites that are affected by CVE-2022-3690. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.com United States**,***
**********.**.il Israel**,***
**************.ca Canada**,***
********.com United States**,***
***********.com United States**,***
*******.de Germany**,***
*****.io Korea, South**,***
*******.com Hong Kong**,***
****.*************.**.uk United States**,***
*******.com United States**,***
See full domain list

FAQ

CVE-2022-3690 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Popup Maker
A total of 36,451 websites have been identified as vulnerable to CVE-2022-3690, discovered through global website indexing conducted by WebTechSurvey.
Popup Maker is susceptible to CVE-2022-3690 vulnerability.
Popup Maker versions before 1.16.11 are vulnerable to CVE-2022-3690.
Version 1.16.11 of Popup Maker addresses the CVE-2022-3690 security vulnerability.