Skip to main content

Popup Builder CVE-2022-32289

MEDIUM
Cross-Site Request Forgery (CSRF) (CWE-352)
2022-07-21 audit@patchstack.com
CSRF WordPress Popup Builder
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 21, 2022 - 16:15 nvd
MEDIUM 4.3

DescriptionNVD

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change. Affected products include: Sygnoos Popup Builder.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Popup Builder

View all
CVE-2023-6000 MEDIUM POC
6.1 Jan 01

The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and inje
CVE-2022-0479 CRITICAL POC
9.8 Mar 28

The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter be
CVE-2020-9006 CRITICAL POC
9.8 Feb 17

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups funct
CVE-2022-0228 HIGH POC
7.2 Feb 21

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters b
CVE-2020-10195 MEDIUM POC
6.3 Mar 13

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to
CVE-2020-10196 MEDIUM POC
6.1 Mar 13

An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary
CVE-2019-14695 CRITICAL
9.8 Aug 06

A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Rated critical sever
CVE-2024-3236 MEDIUM POC
5.4 Jun 17

The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which cou
CVE-2024-9428 MEDIUM POC
4.8 Dec 12

The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow hig
CVE-2023-3226 MEDIUM POC
4.8 Sep 25

The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow hig
CVE-2022-1894 MEDIUM POC
4.8 Jul 11

The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high priv
CVE-2022-29495 MEDIUM POC
4.3 Jul 22

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacke

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2022-32289 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy