CVE-2026-104724

The FireBox – WooCommerce Popup Builder plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 3.1.13 . The root cause is insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries within the FireBox Fo...

EUVD-2026-96066

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

CVE-2025-2011

CVE-2025-2011 - Depicter 插件 SQL 注入漏洞 CVE 参考： CVE-2025-2011 本仓库包含一个用于测试 Depicter Slider & Popup Builder 插件（版本 3.6.2）中 SQL 注入漏洞的概念验证环境。 前提条件 Docker Docker Compose Python 3.x 所需 Python 包：requests、colorama 搭建说明 1. 启动环境 docker-compose up -d 2. 完成 WordPress 安装 打开浏览器并访问 http://localhost:5555 按照 WordPres...

CVE-2026-81929

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the...

CVE-2026-81929 Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the...

EUVD-2026-95509

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the...

CVE-2026-81929

The Ocean Pro Demos (versions up to and including 1.5.4 ) and Ocean eComm Treasure Box (versions up to and including 1.8.0 ) WordPress plugins are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient authorization, input sanitization, and output escaping within the Pop...

Popup Builder < 4.0.7 - SQL Injection

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection. id: CVE-2022-0228 info: name: Popup Builder 4.0.7 -...

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

The Popup Builder WordPress plugin before 4.1.1 is vulnerable to SQL Injection and Reflected XSS via the sgpb-subscription-popup-id parameter. id: CVE-2022-0479 info: name: Popup Builder Plugin - SQL Injection and Cross-Site Scripting author: ritikchaddha severity: critical description: | The Pop...

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS

The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks. id: CVE-2023-6000 info: name: WordPress Popup Builder = 4.2.3 - Unauthenticated Stored XSS author: riteshs4...

WordPress Popup Builder < 4.0.7 - Remote Code Execution

Popup Builder WordPress plugin before 4.0.7 contains a local file inclusion caused by unsanitized 'sgpbtype' parameter in require statement, letting attackers include arbitrary local files or execute code via wrappers like PHAR, exploit requires attacker to control 'sgpbtype' parameter. id:...

CVE-2023-6000

CVE-2023-6000 PoC 这种检测方法是如何工作的？ 此模板会查看以下路径：/wp-content/plugins/popup-builder/readme.txt 根据列出的 Stable Tag，如果版本早于 4.2.3，则视为存在漏洞。 如何运行此脚本？ 1. 从此处下载 Nuclei 2. 将模板复制到你的本地系统 3. 运行以下命令：nuclei -u https://yourHost.com -t template.yaml 参考资料 https://nvd.nist.gov/vuln/detail/CVE-2023-6000...

CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - 通过 wpajaxnoprivshortcodeApiAdd 实现未经认证的任意短代码执行 描述 WordPress 的 WP Popup Builder – Popup Forms and Marketing Lead Generation 插件在 1.3.5 及之前的所有版本中，容易受到通过 wpajaxnoprivshortcodeApiAdd AJAX...

CVE-2025-2011

CVE-2025-2011 PoC 作者： X3RX3S 但自豪地被 Ash Wesker 剥离，这家伙用他的横幅对 GPT 了我的代码 ; 看这里 --- https://github.com/Ashwesker/Blackash-CVE-2025-2011 你甚至可以在“他”的代码里看到我的 handle --' 目的： 一个概念验证工具，用于测试针对 WordPress 站点的 SQL 注入漏洞（CVE-2025-2011）。 免责声明： 仅用于您拥有 或已获得明确书面许可的系统。未经授权的测试是非法且不道德的。 关于漏洞 : WordPress 插件 Slider & Popup...

Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection

The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes ...

CVE-2023-6000-POC

概述 CVE-ID : CVE-2023-6000 CVSS 评分 : 6.1 类型 : 存储型 XSS 修复版本 : Popup Builder 4.2.3 此漏洞允许攻击者利用 WordPress Popup Builder 插件中的跨站脚本（XSS）缺陷。 该插件未能阻止普通用户修改现有弹窗，攻击者可通过向服务器发送特制请求，在弹窗中注入恶意脚本，当用户与弹窗交互时脚本即执行。 对于本 POC，漏洞将通过操控弹窗打开行为触发，注入一个简单的 alert 脚本，在弹窗打开时运行。 此类攻击可导致一系列问题，包括未经授权访问敏感信息以及对受影响网站的进一步利用，可能危及用户数据或整个网...

CVE-2024-52382

CVE-2024-52382 Matix Popup Builder = 1.0.0 - Actualización no autenticada de opciones arbitrarias Descripción El plugin Matix Popup Builder para WordPress es vulnerable a la modificación no autorizada de datos que puede provocar una escalada de privilegios debido a la falta de una verificación de...

cve-2020-9006

CVE-2020-9006：Wordpress Popup-Builder 插件漏洞利用 用法： Create and upload payload Also see: php create-serialized-payload.php -h $ php create-serialized-payload.php | curl -F 'sprunge=-' http://sprunge.us http://sprunge.us/XXXXXX Run exploit $ nmap --script ./cve-2020-9006 --script-args...

CVE-2026-15797: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...