What’s Vulnerable › Products

Popup Builder vulnerabilities

23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your Popup Builder version is affected

Latest Popup Builder vulnerabilities

• CVE-2026-89270 — Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters (CVSS 9.1)
• CVE-2026-112230 — Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter (CVSS 3.7)
• CVE-2025-13079 — Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens (CVSS 5.3)
• CVE-2025-9856 — Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
• CVE-2024-9428 — Popup Builder < 4.3.5 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-2541 — Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File (CVSS 7.5)
• CVE-2024-2544 — Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions (CVSS 6.4)
• CVE-2023-6696 — Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure (CVSS 8.1)
• CVE-2024-2506 — Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS (CVSS 6.4)
• CVE-2023-6294 — popup-builder < 4.2.6 - Admin+ SSRF & File Read (CVSS 7.2)
• CVE-2023-6000 — Popup Builder < 4.2.3 - Unauthenticated Stored XSS (CVSS 6.1)
• CVE-2023-3226 — Popup Builder < 4.2.0 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)
• CVE-2022-29495 — WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update (CVSS 4.3)
• CVE-2022-32289 — WordPress Popup Builder plugin <= 4.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change (CVSS 4.3)
• CVE-2022-1894 — Popup Builder < 4.1.11 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)
• CVE-2022-0479 — Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting (CVSS 9.8)
• CVE-2022-0228 — Popup Builder < 4.0.7 - Admin+ SQL Injection (CVSS 7.2)
• CVE-2021-25082 — Popup Builder < 4.0.7 - LFI to RCE (CVSS 8.8)
• CVE-2021-24152 — Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS) (CVSS 6.1)
• CVE-2020-10196 — (CVSS 6.1)
• CVE-2020-10195 — (CVSS 6.3)
• CVE-2020-9006 — (CVSS 9.8)
• CVE-2019-14695 — (CVSS 9.8)