sygnoos popup builder vulnerabilities and exploits

(subscribe to this query)

The Popup Builder plugin 2.2.8 up to and including 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbit...

Sygnoos Popup Builder

2 Github repositories

The popup-builder plugin prior to 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attac...

Sygnoos Popup-builder

An XSS vulnerability in the popup-builder plugin prior to 3.64.1 for WordPress allows remote malicious users to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated malicious user to insert ma...

Sygnoos Popup-builder

A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin prior to 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote malicious user to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscrib...

Sygnoos Popup Builder

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an malicious user to update plugin settings.

Sygnoos Popup Builder

The Popup Builder WordPress plugin prior to 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vu...

Sygnoos Popup Builder

The Popup Builder WordPress plugin prior to 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.

Sygnoos Popup Builder

1 Article

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.

Sygnoos Popup Builder

The Popup Builder WordPress plugin prior to 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisit...

Sygnoos Popup Builder

The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.

Sygnoos Popup Builder

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook