7.5
High
CVE-2023-6294 The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could…
Description
The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Popup Builder 4.2 | earliest → < 4.2.6 | 4.2.6 |
| popup_builder 4.2 | earliest → < 4.2.6 | 4.2.6 |
Other CVEs of Popup Builder
The 6 CVEs of Popup Builder →
CVE-2026-112230
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content…
3.7
Low
CVE-2024-9428
The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow…
4.8
Medium
CVE-2024-3236
The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which…
5.4
Medium
CVE-2023-6000
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and…
6.1
Medium