Stored XSS to JS backdoor creation

Attackers are able to inject malicious JavaScript into the plugin’s settings, specifically within the “Alt Text” field of an image in the popup. The injected script can be executed when the popup is viewed, enabling attackers to escalate privileges and potentially create a backdoor for account takeover.

CVE number: CVE-2024-9428

This vulnerability affects the following application versions:

• Popup Builder by Forward Looking 3.7
• Popup Builder by Forward Looking 3.7.1
• Popup Builder by Forward Looking 3.69
• Popup Builder by Forward Looking 3.69.1
• Popup Builder by Forward Looking 3.69.2
• Popup Builder by Forward Looking 3.69.3
• Popup Builder by Forward Looking 3.69.4
• Popup Builder by Forward Looking 3.69.5
• Popup Builder by Forward Looking 3.69.6
• Popup Builder by Forward Looking 3.71
• Popup Builder by Forward Looking 3.72
• Popup Builder by Forward Looking 3.73
• Popup Builder by Forward Looking 3.74
• Popup Builder by Forward Looking 3.75
• Popup Builder by Forward Looking 3.76
• Popup Builder by Forward Looking 3.77
• Popup Builder by Forward Looking 3.78
• Popup Builder by Forward Looking 3.79
• Popup Builder by Forward Looking 3.81
• Popup Builder by Forward Looking 3.82
• Popup Builder by Forward Looking 3.83
• Popup Builder by Forward Looking 3.84
• Popup Builder by Forward Looking 4.0
• Popup Builder by Forward Looking 4.0.1
• Popup Builder by Forward Looking 4.0.2
• Popup Builder by Forward Looking 4.0.3
• Popup Builder by Forward Looking 4.0.4
• Popup Builder by Forward Looking 4.0.5
• Popup Builder by Forward Looking 4.0.6
• Popup Builder by Forward Looking 4.0.7
• Popup Builder by Forward Looking 4.0.8
• Popup Builder by Forward Looking 4.0.9
• Popup Builder by Forward Looking 4.1.0
• Popup Builder by Forward Looking 4.1.1
• Popup Builder by Forward Looking 4.1.2
• Popup Builder by Forward Looking 4.1.3
• Popup Builder by Forward Looking 4.1.4
• Popup Builder by Forward Looking 4.1.5
• Popup Builder by Forward Looking 4.1.6
• Popup Builder by Forward Looking 4.1.7
• Popup Builder by Forward Looking 4.1.8
• Popup Builder by Forward Looking 4.1.9
• Popup Builder by Forward Looking 4.1.10
• Popup Builder by Forward Looking 4.1.11
• Popup Builder by Forward Looking 4.1.12
• Popup Builder by Forward Looking 4.1.13
• Popup Builder by Forward Looking 4.1.14
• Popup Builder by Forward Looking 4.1.15
• Popup Builder by Forward Looking 4.2.0
• Popup Builder by Forward Looking 4.2.2
• Popup Builder by Forward Looking 4.2.3
• Popup Builder by Forward Looking 4.2.4
• Popup Builder by Forward Looking 4.2.5
• Popup Builder by Forward Looking 4.2.6
• Popup Builder by Forward Looking 4.2.7
• Popup Builder by Forward Looking 4.3.0
• Popup Builder by Forward Looking 4.3.2
• Popup Builder by Forward Looking 4.3.3
• Popup Builder by Forward Looking 4.3.4