Not rated
CVE-2021-24458 The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use…
Description
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Popup box 2.3 | earliest → < 2.3.4 | 2.3.4 |
Other CVEs of Popup box
The 5 CVEs of Popup box →
CVE-2026-57631
Administrator SQL Injection in Popup box <= 6.0.1 versions
7.6
High
CVE-2026-54192
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions
7.1
High
CVE-2025-69021
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request…
5.4
Medium
CVE-2025-57931
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request…
5.3
Medium