PT-2020-11968 · WordPress · Popup Builder

Name of the Vulnerable Software and Affected Versions: popup-builder plugin versions prior to 3.64.1 Description: The issue allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST reques...

Popup Builder < 3.64.1 - Multiple Issues

"One vulnerability allowed an unauthenticated attacker to inject malicious JavaScript into any published popup, which would then be executed whenever the popup loaded. The other vulnerability allowed any logged-in user, even those with minimal permissions such as a subscriber, to export a list of...

WordPress Popup Builder Plugin 2.2.8 < 3.0 SQL Injection Vulnerability

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

WordPress Popup Builder SQL Injection Vulnerability (CNVD-2020-13888)

WordPress is a blogging platform developed using the PHP language, which allows users to set up their own websites on servers that support PHP and MySQL databases.Popup Builder is a wordpress plugin used to create outstanding popup windows. An injection vulnerability exists in WordPress Popup...

WordPress Popup Builder SQL Injection Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Popup Builder is a popup plugin used in it. A SQL injection vulnerability exists in the 'sgImportPopups' function of the...

CVE-2020-9006

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection in the sgImportPopups function in sgpopupajax.php via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator...

CVE-2020-9006

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection in the sgImportPopups function in sgpopupajax.php via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator...

Sql injection

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection in the sgImportPopups function in sgpopupajax.php via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator...

CVE-2020-9006

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection in the sgImportPopups function in sgpopupajax.php via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator...

CVE-2020-9006

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection in the sgImportPopups function in sgpopupajax.php via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator...

CVE-2020-9006

Summary: WordPress Popup Builder plugin versions 2.2.8–2.6.7.6 are vulnerable to SQL injection via PHP deserialization in sg_popup_ajax.php (sgImportPopups) using the attachmentUrl POST data. This can allow an attacker to create an arbitrary WordPress Administrator account, enabling possible Remo...

Popup Builder < 3.0 - SQL injection via PHP Deserialization

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution...

WordPress Popup Builder plugin <= 2.6.7.6 - SQL injection (SQLi) vulnerability

SQL injection SQLi vulnerability discovered by ZeroAuth in WordPress Popup Builder plugin versions = 2.6.7.6. Solution Update the WordPress Popup Builder plugin to the latest available version at least 3.0.2...

WordPress Plugin Popup Builder 3.49 - Persistent Cross-Site Scripting

WordPress Plugin Popup Builder 3.49 - Persistent Cross-Site Scripting Exploit Title: Wordpress Popup Builder 3.49 - Persistent Cross-Site Scripting Google Dork: inurl:"\wp-content\plugins\popupbuilder" Date: 2019-06-13 Exploit Author: Unk9vvN Vendor Homepage: https://popup-builder.com/ Software...

WordPress Plugin Popup Builder 3.49 - Persistent Cross-Site Scripting

Exploit Title: Wordpress Popup Builder 3.49 - Persistent Cross-Site Scripting Google Dork: inurl:"\wp-content\plugins\popupbuilder" Date: 2019-06-13 Exploit Author: Unk9vvN Vendor Homepage: https://popup-builder.com/ Software Link: https://wordpress.org/plugins/popup-builder/ Version: 3.49 Tested...

WordPress Popup Builder 3.49 Cross Site Scripting

Exploit Title: Wordpress Popup Builder 3.49 - Persistent Cross-Site Scripting Google Dork: inurl:"\wp-content\plugins\popupbuilder" Date: 2019-06-13 Exploit Author: Unk9vvN Vendor Homepage: https://popup-builder.com/ Software Link: https://wordpress.org/plugins/popup-builder/ Version: 3.49 Tested...

Popup Builder Plugin for WordPress < 3.45 SQL Injection

The WordPress Popup Builder Plugin installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input. A remote attacker can exploit this issue to manipulate SQL queries, resulting in the disclosure of sensitive information and modificati...

WordPress Sygnoos Popup Builder Plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Sygnoos Popup Builder is one of the popup plugins used in it. A SQL injection vulnerability exists in WordPress Sygnoos Popup Builder...

WordPress Popup Builder Plugin < 3.45 SQL Injection Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2019-14695

A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is...