241 matches found
CVE-2026-100159
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
CVE-2026-100159
The Popup Box plugin for WordPress (versions 6.4.1 to 6.4.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the ays_popup_get_user_ip() function, which reads client-controlled headers (such as Client-IP and X-Forwarded-For) and inadequately sanitizes them usin...
EUVD-2026-102592
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
CVE-2026-100159 Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
CVE-2026-100159: Improper Control of Generation of Code
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
WordPress Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin 6.4.1-6.4.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by YCInfosec in WordPress Plugin Popup box versions 6.4.1-6.4.2...
CVE-2026-57631
Administrator SQL Injection in Popup box = 6.0.1 versions...
EUVD-2026-39747
Administrator SQL Injection in Popup box = 6.0.1 versions...
CVE-2026-57631
CVE-2026-57631 affects the WordPress Popup box plugin (versions
CVE-2026-57631 WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
Administrator SQL Injection in Popup box = 6.0.1 versions...
CVE-2026-57631 WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
Administrator SQL Injection in Popup box = 6.0.1 versions...
CVE-2026-57631
Administrator SQL Injection in Popup box = 6.0.1 versions...
WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Doan Dinh Van in WordPress Plugin Popup box versions = 6.0.1...
CVE-2026-57631: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Popup box = 6.0.1 versions...
PT-2026-52802
Administrator SQL Injection in Popup box = 6.0.1 versions...
EUVD-2026-37635
Unauthenticated Cross Site Scripting XSS in Popup box = 6.2.9 versions...
CVE-2026-54192
Unauthenticated Cross Site Scripting XSS in Popup box = 6.2.9 versions...
CVE-2026-54192
This entry covers CVE-2026-54192: unauthenticated Reflected XSS in the WordPress Popup box plugin (<= 6.2.9). The descriptor indicates an XSS vulnerability when loading or handling inputs in affected plugin paths, with a CVSS v3.1 base score of 7.1 (HIGH) and user interaction required. The pro...