Not rated
CVE-2021-25082 The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it…
Description
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Popup Builder – Create highly converting, mobile friendly marketing popups. 4.0 | earliest → < 4.0.7 | 4.0.7 |
Other CVEs of Popup Builder – Create highly converting, mobile friendly marketing popups.
The 4 CVEs of Popup Builder – Create highly converting, mobile friendly marketing popups. →
CVE-2022-1894
The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high…
Not rated
CVE-2022-0479
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter…
Not rated
CVE-2022-0228
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters…
Not rated