Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
WP Popups - Security Vulnerability (CVE-2024-6555)
The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
PLUGIN
WP Popups
CVE-2024-6555
Risk Score
Threat Entry
Updated 2026-06-17
Wp Popups - Cross-Site Scripting (XSS) (CVE-2023-1905)
The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003
PLUGIN
Wp Popups
CVE-2023-1905
Risk Score
Threat Entry
Updated 2026-06-17
Wp Popups - Cross-Site Scripting (XSS) (CVE-2023-24003)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin
PLUGIN
Wp Popups
CVE-2023-24003
Risk Score
Threat Entry
Updated 2026-06-17
Wp Popups - Cross-Site Scripting (XSS) (CVE-2022-4716)
The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
PLUGIN
Wp Popups
CVE-2022-4716
Risk Score