CVE-2021-25082

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpbtype parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via...

CVE-2021-25082

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpbtype parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via...

CVE-2022-0228

CVE-2022-0228 concerns the WordPress plugin Popup Builder prior to version 4.0.7. The authenticated admin pages fail to validate/escape the orderby and order parameters before building SQL statements in the admin dashboard, enabling a SQL injection (CWE-89). Several sources (NVD entry and Nuclei/...

CVE-2022-0228 Popup Builder < 4.0.7 - Admin+ SQL Injection

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection...

CVE-2021-25082

CVE-2021-25082 affects the WordPress plugin Popup Builder, pre-4.0.7. A local file inclusion (LFI) exists due to unsanitized and unvalidated sgpb_type being used in a require statement. An attacker controllling the beginning of sgpb_type can leverage this to include arbitrary local files and pote...

WordPress plugin Popup Builder 路径遍历漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . WordPress plugin Popup Builder there is a path traversal...

Wordpress Plugin Popup Builder SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in the...

PT-2022-9638

Name of the Vulnerable Software and Affected Versions Popup Builder WordPress plugin versions prior to 4.0.7 Description The issue is related to a Local File Inclusion problem due to the lack of validation and sanitization of the sgpb type parameter, which is used in a require statement. This can...

Cross-site Scripting (XSS) - Stored

Stored-xss is possible when adding a rule. Create a new Alert Rule like below and adjust the query like below with the following payload " Save the rule and see a xss-pop up...

WordPress Custom Popup Builde plugin denial of service vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. A denial of service vulnerability exists in versions of the WordPress Custom Popup Builde plugin prior to 1.3.1,...

CVE-2022-0214

The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog...

CVE-2022-0214

The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog...

Denial of service

The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog...

CVE-2022-0214 Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service

The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog...

CVE-2022-0214

The CVE-2022-0214 issue affects the WordPress plugin “Custom Popup Builder” prior to v1.3.1. The popup data autoloads on every page and can be populated by unauthenticated input, with length not being validated, enabling a denial of service on the blog. Affected software: WordPress Custom Popup B...

WordPress和WordPress plugin 资源管理错误漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. A denial of service vulnerability exists in versions of the WordPress Custom Popup Builde plugin prior to 1.3.1,...

Login/Signup Popup Plugin for WordPress < 2.3 Cross-Site Request Forgery

The WordPress Login/Signup Popup Plugin installed on the remote host is affected by a Cross-Site Request Forgery CSRF vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Mageia: Security Advisory (MGASA-2022-0019)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Popup Builder plugin <= 4.0.6 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered in WordPress Popup Builder plugin versions = 4.0.6. Solution Update the WordPress Popup Builder plugin to the latest available version at least 4.0.7...

Popup Builder < 4.0.7 - Admin+ SQL Injection

The plugin does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection...