CVE-2024-3231: Ivanweb POPUP4PHONE

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.

Affected products

• Ivanweb POPUP4PHONE: up to and including 1.3.2

Published 2024-05-17. Last modified 2026-06-17.