danieliser Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your danieliser Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder version is affected

Latest danieliser Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder vulnerabilities

CVE-2026-85004 — Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect (CVSS 4.3)
CVE-2026-87915 — Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter (CVSS 7.2)
CVE-2026-15797 — Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title (CVSS 6.4)
CVE-2026-28177 — WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2026-8848 — Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation (CVSS 7.2)
CVE-2025-9490 — Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter (CVSS 6.4)
CVE-2025-4205 — Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter (CVSS 6.4)
CVE-2025-24746 — WordPress Popup Maker plugin <= 1.20.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2022-45819 — WordPress Popup Maker plugin <= 1.17.1 - Broken Access Control vulnerability (CVSS 3.5)
CVE-2024-10583 — Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2024-47358 — WordPress Popup Maker plugin <= 1.19.2 - Broken Access Control vulnerability (CVSS 9.8)
CVE-2024-5561 — Popup Maker < 1.19.1 - Admin+ Stored XSS (CVSS 4.8)
CVE-2024-7054 — Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2024-2336 — Popup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2022-47597 — WordPress Popup Maker Plugin <= 1.17.1 is vulnerable to Sensitive Data Exposure (CVSS 7.5)
CVE-2022-4381 — Popup Maker < 1.16.9 - Contributor+ Stored XSS via Subscription Form (CVSS 5.4)
CVE-2022-4362 — Popup Maker < 1.16.9 - Contributor+ Stored XSS via Shortcode (CVSS 5.4)
CVE-2022-3690 — Popup Maker < 1.16.11 - Contributor+ Stored Cross Site Scripting (CVSS 4.8)
CVE-2022-1104 — Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)
CVE-2019-17574 — (CVSS 9.1)
CVE-2017-2284 — (CVSS 6.1)