Timersys develops WordPress popup and modal plugins that are positioned as customization tools for site administrators, representing a focused footprint in the WordPress plugin ecosystem. The observed vulnerability signal centers on cross-site scripting weaknesses in these plugins' form and content-generation functions, a class of flaw endemic to dynamically rendered web components. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Timersys over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-4716MEDIUM The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a | Jan 23, 2023 | 5.4 | 20 | NO | NO |
CVE-2023-1905MEDIUM The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shor | May 8, 2023 | 5.4 | 19 | NO | NO |
CVE-2023-24003MEDIUM Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin <= 2.1.4.8 versions. | Apr 6, 2023 | 5.4 | 19 | NO | NO |
CVE-2022-2305MEDIUM The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross | Aug 1, 2022 | 4.8 | 19 | NO | NO |
CVE-2024-29105MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timersys WP Popups allows Stored XSS.This issue affects WP Popups: from n/a th | Mar 19, 2024 | 5.9 | 17 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Timersys.
Media articles that mention a CVE ID that affects a product developed by Timersys — matched by CVE ID, not by vendor name.