The Brave Popup Builder plugin, versions through 0.8.5, has a broken access control issue. This vulnerability allows logged-in users, including Subscribers and WooCommerce Customers, to read popup content they shouldn't have access to by passing a post ID in the URL. The issue poses a medium-severity risk, potentially leading to unauthorized access and data exposure. WordPress administrators and users wit [truncated]
The Brave Popup Builder plugin up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them, allowing for potential XSS attacks. This vulnerability could impact web applications using the plugin, as attackers may exploit the reflected UTM query parameters to execute malicious scripts. Defenders should assess exposure and prioritize verification of the plugin version to prev [truncated]
