CVE-2026-100159

The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...

CVE-2026-100159

The Popup Box plugin for WordPress (versions 6.4.1 to 6.4.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the ays_popup_get_user_ip() function, which reads client-controlled headers (such as Client-IP and X-Forwarded-For) and inadequately sanitizes them usin...

EUVD-2026-102592

The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...