CVE-2019-25744

Name of the Vulnerable Software and Affected Versions WordPress Popup Builder version 3.49

Description A persistent cross-site scripting issue allows authenticated attackers to inject malicious scripts. This is achieved by breaking out of option tags using the post title parameter. Attackers can send crafted POST requests to the "/post.php" endpoint with script payloads in the post title field, which then execute when pages or posts display popup selections.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.