Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Popup Builder - SQL Injection (CVE-2022-0228)
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
PLUGIN
Popup Builder
CVE-2022-0228
Risk Score
Threat Entry
Updated 2026-06-17
Popup Builder - Remote Code Execution (CVE-2021-25082)
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
PLUGIN
Popup Builder
CVE-2021-25082
Risk Score
Threat Entry
Updated 2026-06-17
Popup Builder - Privilege Escalation (CVE-2020-10195)
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the…
PLUGIN
Popup Builder
CVE-2020-10195
Risk Score
Threat Entry
Updated 2026-06-17
Popup Builder - Cross-Site Scripting (XSS) (CVE-2020-10196)
An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several of the popup's fields by sending a request to wp-admin/admin-ajax.php with the POST action parameter of sgpb_autosave and including additional data in an allPopupData parameter, including the popup's ID (which is visible in the source of the page in which the popup is inserted) and arbitrary JavaScript which will…
PLUGIN
Popup Builder
CVE-2020-10196
Risk Score
Threat Entry
Updated 2026-06-17
Popup Builder - SQL Injection (CVE-2020-9006)
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)
PLUGIN
Popup Builder
CVE-2020-9006
Risk Score
Threat Entry
Updated 2026-06-17
Popup Builder - SQL Injection (CVE-2019-14695)
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is mishandled.
PLUGIN
Popup Builder
CVE-2019-14695
Risk Score