Non notée
CVE-2021-24458 The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use…
Description
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Popup box 2.3 | premières → < 2.3.4 | 2.3.4 |
Autres CVE de Popup box
Les 5 CVE de Popup box →
CVE-2026-57631
Administrator SQL Injection in Popup box <= 6.0.1 versions
7.6
Élevée
CVE-2026-54192
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions
7.1
Élevée
CVE-2025-69021
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request…
5.4
Moyenne
CVE-2025-57931
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request…
5.3
Moyenne