CVE-2022-0214: Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-14 · updated 2026-06-17
Weakness: CWE-1284

Description

The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog

Affected products

Popup | Custom Popup Builder: before 1.3.1 — fixed in 1.3.1

How to fix

Upgrade to a fixed version: Popup | Custom Popup Builder 1.3.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4
https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4

Get alerted when CVE-2022-0214 or the next vulnerability affects your stack