sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total20
Critical0
High5
Medium15
Reset
Showing 1-20 of 20 records
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Request Forgery (CSRF) (CVE-2025-15611)

The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.

PLUGIN Popup Box

CVE-2025-15611

MEDIUM CVSS 5.4 2026-04-07
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Scripting (XSS) (CVE-2025-12122)

The Popup Box – Easily Create WordPress Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Popup Box

CVE-2025-12122

MEDIUM CVSS 6.4 2026-02-18
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Request Forgery (CSRF) (CVE-2026-1165)

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish status of popups via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

PLUGIN Popup Box

CVE-2026-1165

MEDIUM CVSS 4.3 2026-01-31
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Scripting (XSS) (CVE-2024-9599)

The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Popup Box

CVE-2024-9599

MEDIUM CVSS 5.4 2025-05-15
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Broken Access Control (CVE-2024-10861)

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.

PLUGIN Popup Box

CVE-2024-10861

MEDIUM CVSS 5.3 2024-11-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Broken Access Control (CVE-2024-3897)

The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on the website.

PLUGIN Popup Box

CVE-2024-3897

MEDIUM CVSS 5.3 2024-05-02
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Scripting (XSS) (CVE-2023-6591)

The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

PLUGIN Popup Box

CVE-2023-6591

MEDIUM CVSS 4.8 2024-02-12
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Scripting (XSS) (CVE-2023-5874)

The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Popup Box

CVE-2023-5874

MEDIUM CVSS 4.8 2023-12-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Scripting (XSS) (CVE-2023-5809)

The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Popup Box

CVE-2023-5809

MEDIUM CVSS 4.8 2023-12-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Scripting (XSS) (CVE-2023-5343)

The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

PLUGIN Popup Box

CVE-2023-5343

MEDIUM CVSS 4.8 2023-11-20
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Scripting (XSS) (CVE-2023-4390)

The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

PLUGIN Popup Box

CVE-2023-4390

MEDIUM CVSS 4.8 2023-10-31
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - Cross-Site Scripting (XSS) (CVE-2023-2362)

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to…

PLUGIN Popup Box

CVE-2023-2362

MEDIUM CVSS 6.1 2023-06-12
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - SQL Injection (CVE-2021-24460)

The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

PLUGIN Popup Box

CVE-2021-24460

HIGH CVSS 8.8 2021-08-02
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Popup Box - SQL Injection (CVE-2021-24458)

The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

PLUGIN Popup Box

CVE-2021-24458

HIGH CVSS 8.8 2021-08-02
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.