Not rated
CVE-2022-0479 The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter…
Description
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Popup Builder – Create highly converting, mobile friendly marketing popups. 4.1 | earliest → < 4.1.1 | 4.1.1 |
Other CVEs of Popup Builder – Create highly converting, mobile friendly marketing popups.
The 4 CVEs of Popup Builder – Create highly converting, mobile friendly marketing popups. →
CVE-2022-1894
The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high…
Not rated
CVE-2022-0228
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters…
Not rated
CVE-2021-25082
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it…
Not rated