{"id":"CVE-2024-3236","aliases":["EUVD-2024-31828","GHSA-qp28-67v3-65qc"],"status":"published","title":"Easy Notify Lite \u003c 1.1.33 - Contributor+ Stored XSS","description":"The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00312,"percentile":0.24315,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-06-17T06:00:01Z","modified":"2026-06-17T07:43:35Z","products":[{"vendor":"ghozylab","product":"gallery_for_social_photo"},{"vendor":"ghozylab","product":"popup builder"},{"vendor":"ghozylab","product":"popup_builder"},{"vendor":"unknown","product":"popup builder"}],"references":[{"url":"https://wpscan.com/vulnerability/a6c2da28-dc03-4bcc-a6c3-ee55a73861db/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3236"},{"url":"https://wpscan.com/vulnerability/a6c2da28-dc03-4bcc-a6c3-ee55a73861db"},{"url":"https://github.com/advisories/GHSA-qp28-67v3-65qc"}],"sources":{"cve":[{"id":"CVE-2024-3236","title":"Easy Notify Lite \u003c 1.1.33 - Contributor+ Stored XSS","description":"The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.","status":"published","published":"2024-06-17T06:00:01.133Z","modified":"2024-08-01T20:05:08.361Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:10.613319Z"}],"euvd":[{"id":"EUVD-2024-31828","description":"The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.","status":"published","published":"2024-06-17T06:00:01Z","modified":"2024-08-01T20:05:08Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:39.0087Z"}],"ghsa":[{"id":"GHSA-qp28-67v3-65qc","title":"The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its...","description":"The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.","status":"published","published":"2024-06-17T06:30:34Z","modified":"2025-05-13T03:31:13Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:14.75912Z"}],"nvd":[{"id":"CVE-2024-3236","description":"The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.","status":"published","published":"2024-06-17T06:15:08.923Z","modified":"2026-06-17T07:43:35.477Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:05.620461Z"}]}}