Buzz
With Popup Builder, website owners can create, deploy, and manage customizable pop-up windows. These pop-ups can contain various content, from HTML and JavaScript code to images and videos.
The author of this plugin, Sygnoos, has advertised it as a tool that can boost revenue through pop-up windows, used for displaying ads, registration requests, discounts, and various other advertising content.
Vulnerabilities for Information Disclosure and XSS Attacks
The security vulnerabilities discovered by Defiant QA Engineer Ram Gall affect all versions and include Popup Builder 3.63.
Gall stated: 'One vulnerability allows attackers to inject malicious JavaScript into any public-facing pop-up window. The malicious code will then execute whenever the pop-up window is loaded. Typically, attackers use such vulnerabilities to redirect visitors to malicious advertising websites or steal sensitive information from their browsers, although it could also be used to take over the website if an administrator accesses or previews a page containing an infected pop-up window while logged in.'
Another flaw allows any logged-in user with access to plugin features to export mailing list subscribers and system configuration information with a simple POST request to admin-post.php.
The vulnerability has been patched, but tens of thousands are still under attack
The tracked vulnerabilities are CVE-2020-10196 and CVE-2020-10195, allowing for Stored XSS attacks, configuration disclosure, user data export, and website settings modification.
Sygnoos addressed the security incident by releasing Popup Builder 3.64.1 a week after Defiant reported the issue.
