PT-2022-7046

Name of the Vulnerable Software and Affected Versions Popup Builder WordPress plugin versions prior to 4.0.7 Description The issue is related to the lack of protection against SQL query structure exploitation when handling orderby and order parameters in the admin-post.php script of the Popup...

Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service

The plugin autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog 1 Create a popup as admin and access the popup page as unauthenticated 2 Send data on the form and intercept t...

Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service

The plugin autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog PoC 1 Create a popup as admin and access the popup page as unauthenticated 2 Send data on the form and interce...

WordPress Popup | Custom Popup Builder plugin <= 1.3 - Unauthenticated Denial of Service (DoS) vulnerability

Unauthenticated Denial of Service DoS vulnerability discovered by Felipe de Avila in WordPress Popup | Custom Popup Builder plugin versions = 1.3. Solution Update the WordPress Popup | Custom Popup Builder plugin to the latest available version at least 1.3.1...

CVE-2021-24152

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

CVE-2021-24152

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

Cross site scripting

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

CVE-2021-24152

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

CVE-2021-24152 Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS)

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

CVE-2021-24152

Popup Builder (WordPress plugin) is affected by CVE-2021-24152, a reflected XSS in the All Subscribers setting page. The vulnerability affects versions prior to 3.74, and requires an authenticated attacker to entice a logged-in user to a crafted URL to execute arbitrary scripts in the user’s brow...

WordPress Popup Builder 跨站脚本漏洞

WordPress Popup Builder is a WordPress open source application. Increase conversions and drive sales while achieving marketing goals. Popup Builder suffers from a cross-site scripting vulnerability that stems from the vulnerability of all subscriber settings pages to cross-site scripting...

CVE-2021-24152: Improper Neutralization of Input During Web Page Generation

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting...

PT-2021-15697

Name of the Vulnerable Software and Affected Versions: Popup Builder affected versions not specified Description: The issue concerns a reflected Cross-Site Scripting vulnerability in the "All Subscribers" setting page of Popup Builder. Recommendations: At the moment, there is no information about...

Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS)

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting. http://example.com/wp-admin/edit.php?posttype=popupbuilder&page=sgpbSubscribers&sgpb-subscribers-date=%22%3E%3Cscript%3Ealert%28origin%29%3C%2Fscript%3E Video:...

Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS)

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting. PoC http://example.com/wp-admin/edit.php?posttype=popupbuilder=sgpbSubscribers&sgpb-subscribers-date;=%22%3E%3Cscript%3Ealert%28origin%29%3C%2Fscript%3E Video:...

WordPress Pop-Up Builder Plugin Flaw Plagues 200K Sites

Developers of a plugin, used by WordPress websites for building pop-up ads for newsletter subscriptions, have issued a patch for a serious flaw. The vulnerability could be exploited by attackers to send out newsletters with custom content, or to delete or import newsletter subscribers. The plugin...

WordPress Popup Builder plugin <= 3.71 - Authenticated Local File Inclusion (LFI) vulnerability

Authenticated Local File Inclusion LFI vulnerability found by Dave Jong WebARX Security in WordPress Popup Builder plugin versions = 3.71. Solution Update the WordPress Popup Builder plugin to the latest available version at least 3.72...

WordPress Popup Builder plugin <= 3.71 - Authenticated Deleting/Importing Subscribers vulnerability

Authenticated Deleting/Importing Subscribers vulnerability found by Dave Jong WebARX Security in WordPress Popup Builder plugin versions = 3.71. Solution Update the WordPress Popup Builder plugin to the latest available version at least 3.72...

WordPress Popup Builder plugin <= 3.71 - Authenticated Newsletter Send With Custom Content And Sender vulnerability

Authenticated Newsletter Send With Custom Content And Sender vulnerability found by Dave Jong WebARX Security in WordPress Popup Builder plugin versions = 3.71. Solution Update the WordPress Popup Builder plugin to the latest available version at least 3.72...

WordPress Popup Builder plugin <= 3.69.6 - Multiple Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Cross-Site Scripting XSS vulnerabilities were found by Ilca Lucian Florin in the WordPress Popup Builder plugin versions = 3.69.6. Solution 2020-12-14 - awaiting patch approval...