CVE-2020-36715highobserved exploitationCWE-862

CVE-2020-36715: high-severity vulnerability in xootix Login & Register Customizer – Popup |…

Login/Signup Popup < 1.5 - Missing Authorization

Published · Updated

Follow this CVE+ Monitor Login & Register Customizer – Popup | Slider | Inline | WooCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 7.4epss 0.7%
from disclosure to weapon
Published on NVDJun 7
VulnCheckMay 14
The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts into the plugin settings that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected products
xootix · Login & Register Customizer – Popup | Slider | Inline | WooCommerce
Related CVEs — xootix Login & Register Customizer – Popup |…

In the same product, most dangerous first.

CVE-2024-5324HIGHXootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options UpdateEPSS 1.5%CVE-2025-1064MEDIUMLogin/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action ShortcodeEPSS 0.3%