244 matches found
CVE-2026-100159
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
EUVD-2026-102592
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
CVE-2026-100159
The Popup Box plugin for WordPress (versions 6.4.1 to 6.4.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the ays_popup_get_user_ip() function, which reads client-controlled headers (such as Client-IP and X-Forwarded-For) and inadequately sanitizes them usin...
CVE-2026-100159 Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
CVE-2026-100159 Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
CVE-2026-100159: Improper Control of Generation of Code
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ayspopupgetuserip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only wit...
PT-2026-115396
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays popup get user ip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only...
WordPress Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin 6.4.1-6.4.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by YCInfosec in WordPress Plugin Popup box versions 6.4.1-6.4.2...
WordPress Popup Box code injection vulnerability
The WordPress Popup Box version 6.4.1 to 6.4.2 has a code injection vulnerability. This vulnerability stems from the ayspopupgetuserip function, which reads request headers such as Client-IP and X-Forwarded-For that are controllable by the client. Only sanitizetextfield is used for cleaning these...
CVE-2026-57631
Administrator SQL Injection in Popup box = 6.0.1 versions...
CVE-2026-57631
CVE-2026-57631 affects the WordPress Popup box plugin (versions
CVE-2026-57631 WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
Administrator SQL Injection in Popup box = 6.0.1 versions...
CVE-2026-57631 WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
Administrator SQL Injection in Popup box = 6.0.1 versions...
EUVD-2026-39747
Administrator SQL Injection in Popup box = 6.0.1 versions...
CVE-2026-57631
Administrator SQL Injection in Popup box = 6.0.1 versions...
WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Doan Dinh Van in WordPress Plugin Popup box versions = 6.0.1...
CVE-2026-57631: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Popup box = 6.0.1 versions...
PT-2026-52802
Name of the Vulnerable Software and Affected Versions affected versions not specified versions prior to 6.0.1 Description An SQL Injection issue exists in the popup box, allowing an administrator to execute arbitrary SQL commands. Recommendations Update to a version newer than 6.0.1...