Unvalidated html attribute names and values enable XSS injection

The createAttrs() method constructs html attributes by directly concatenating user-controlled attribute names and values into the output string without any validation or sanitization. This allows attackers to inject specially crafted attribute names containing quotes or special characters to break out of the attribute context, or to inject malicious attribute values containing JavaScript event handlers

This vulnerability affects the following application versions:

• Popup Builder by Forward Looking 3.0.2
• Popup Builder by Forward Looking 3.0.3
• Popup Builder by Forward Looking 3.0.4
• Popup Builder by Forward Looking 3.0.5
• Popup Builder by Forward Looking 3.0.6
• Popup Builder by Forward Looking 3.0.7
• Popup Builder by Forward Looking 3.0.8
• Popup Builder by Forward Looking 3.0.9
• Popup Builder by Forward Looking 3.0.9.1
• Popup Builder by Forward Looking 3.1
• Popup Builder by Forward Looking 3.1.1
• Popup Builder by Forward Looking 3.1.2
• Popup Builder by Forward Looking 3.1.3
• Popup Builder by Forward Looking 3.1.4
• Popup Builder by Forward Looking 3.1.4.1
• Popup Builder by Forward Looking 3.1.5
• Popup Builder by Forward Looking 3.1.5.1
• Popup Builder by Forward Looking 3.1.5.2
• Popup Builder by Forward Looking 3.1.6
• Popup Builder by Forward Looking 3.1.6.1
• Popup Builder by Forward Looking 3.1.7
• Popup Builder by Forward Looking 3.1.7.1
• Popup Builder by Forward Looking 3.1.8
• Popup Builder by Forward Looking 3.1.9
• Popup Builder by Forward Looking 3.2
• Popup Builder by Forward Looking 3.3
• Popup Builder by Forward Looking 3.4
• Popup Builder by Forward Looking 3.7
• Popup Builder by Forward Looking 3.7.1
• Popup Builder by Forward Looking 3.41
• Popup Builder by Forward Looking 3.42
• Popup Builder by Forward Looking 3.43
• Popup Builder by Forward Looking 3.44
• Popup Builder by Forward Looking 3.45
• Popup Builder by Forward Looking 3.46
• Popup Builder by Forward Looking 3.47
• Popup Builder by Forward Looking 3.48
• Popup Builder by Forward Looking 3.49
• Popup Builder by Forward Looking 3.50
• Popup Builder by Forward Looking 3.51
• Popup Builder by Forward Looking 3.52
• Popup Builder by Forward Looking 3.53
• Popup Builder by Forward Looking 3.54
• Popup Builder by Forward Looking 3.55
• Popup Builder by Forward Looking 3.56
• Popup Builder by Forward Looking 3.57
• Popup Builder by Forward Looking 3.58
• Popup Builder by Forward Looking 3.59
• Popup Builder by Forward Looking 3.60
• Popup Builder by Forward Looking 3.61
• Popup Builder by Forward Looking 3.61.1
• Popup Builder by Forward Looking 3.62
• Popup Builder by Forward Looking 3.62.1
• Popup Builder by Forward Looking 3.63
• Popup Builder by Forward Looking 3.64
• Popup Builder by Forward Looking 3.64.1
• Popup Builder by Forward Looking 3.65
• Popup Builder by Forward Looking 3.65.1
• Popup Builder by Forward Looking 3.65.2
• Popup Builder by Forward Looking 3.66
• Popup Builder by Forward Looking 3.67
• Popup Builder by Forward Looking 3.68.1
• Popup Builder by Forward Looking 3.68.2
• Popup Builder by Forward Looking 3.68.3
• Popup Builder by Forward Looking 3.68.4
• Popup Builder by Forward Looking 3.68.5
• Popup Builder by Forward Looking 3.68.5.1
• Popup Builder by Forward Looking 3.68.5.2
• Popup Builder by Forward Looking 3.69
• Popup Builder by Forward Looking 3.69.1
• Popup Builder by Forward Looking 3.69.2
• Popup Builder by Forward Looking 3.69.3
• Popup Builder by Forward Looking 3.69.4
• Popup Builder by Forward Looking 3.69.5
• Popup Builder by Forward Looking 3.69.6
• Popup Builder by Forward Looking 3.71
• Popup Builder by Forward Looking 3.72
• Popup Builder by Forward Looking 3.73
• Popup Builder by Forward Looking 3.74
• Popup Builder by Forward Looking 3.75
• Popup Builder by Forward Looking 3.76
• Popup Builder by Forward Looking 3.77
• Popup Builder by Forward Looking 3.78
• Popup Builder by Forward Looking 3.79
• Popup Builder by Forward Looking 3.81
• Popup Builder by Forward Looking 3.82
• Popup Builder by Forward Looking 3.83
• Popup Builder by Forward Looking 3.84
• Popup Builder by Forward Looking 4.0
• Popup Builder by Forward Looking 4.0.1
• Popup Builder by Forward Looking 4.0.2
• Popup Builder by Forward Looking 4.0.3
• Popup Builder by Forward Looking 4.0.4
• Popup Builder by Forward Looking 4.0.5
• Popup Builder by Forward Looking 4.0.6
• Popup Builder by Forward Looking 4.0.7
• Popup Builder by Forward Looking 4.0.8
• Popup Builder by Forward Looking 4.0.9
• Popup Builder by Forward Looking 4.1.0
• Popup Builder by Forward Looking 4.1.1
• Popup Builder by Forward Looking 4.1.2
• Popup Builder by Forward Looking 4.1.3
• Popup Builder by Forward Looking 4.1.4
• Popup Builder by Forward Looking 4.1.5
• Popup Builder by Forward Looking 4.1.6
• Popup Builder by Forward Looking 4.1.7
• Popup Builder by Forward Looking 4.1.8
• Popup Builder by Forward Looking 4.1.9
• Popup Builder by Forward Looking 4.1.10
• Popup Builder by Forward Looking 4.1.11
• Popup Builder by Forward Looking 4.1.12
• Popup Builder by Forward Looking 4.1.13
• Popup Builder by Forward Looking 4.1.14
• Popup Builder by Forward Looking 4.1.15
• Popup Builder by Forward Looking 4.2.0
• Popup Builder by Forward Looking 4.2.2
• Popup Builder by Forward Looking 4.2.3
• Popup Builder by Forward Looking 4.2.4
• Popup Builder by Forward Looking 4.2.5
• Popup Builder by Forward Looking 4.2.6
• Popup Builder by Forward Looking 4.2.7
• Popup Builder by Forward Looking 4.3.0
• Popup Builder by Forward Looking 4.3.2
• Popup Builder by Forward Looking 4.3.3
• Popup Builder by Forward Looking 4.3.4
• Popup Builder by Forward Looking 4.3.5
• Popup Builder by Forward Looking 4.3.6
• Popup Builder by Forward Looking 4.3.7
• Popup Builder by Forward Looking 4.3.8
• Popup Builder by Forward Looking 4.3.9
• Popup Builder by Forward Looking 4.4.0
• Popup Builder by Forward Looking 4.4.1