Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
popup vulnerabilities and exploits
(subscribe to this query)
7.2
CVSSv3
CVE-2023-0924
The ZYREX POPUP WordPress plugin up to and including 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multi...
Zyrex Popup
5.3
CVSSv3
CVE-2022-0424
The Popup by Supsystic WordPress plugin prior to 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated malicious users to call it and get the email addresses of subscribed users
Supsystic Popup
9.8
CVSSv3
CVE-2023-3186
The Popup by Supsystic WordPress plugin prior to 1.10.19 has a prototype pollution vulnerability that could allow an malicious user to inject arbitrary properties into Object.prototype.
Supsystic Popup
6.1
CVSSv3
CVE-2021-24275
The Popup by Supsystic WordPress plugin prior to 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
Supsystic Popup
8.8
CVSSv3
CVE-2016-10915
The popup-by-supsystic plugin prior to 1.7.9 for WordPress has CSRF.
Supsystic Popup
8.8
CVSSv3
CVE-2021-25082
The Popup Builder WordPress plugin prior to 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vu...
Sygnoos Popup Builder
9.8
CVSSv3
CVE-2020-9006
The Popup Builder plugin 2.2.8 up to and including 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbit...
Sygnoos Popup Builder
2 Github repositories
4.3
CVSSv3
CVE-2022-29495
Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an malicious user to update plugin settings.
Sygnoos Popup Builder
4.8
CVSSv3
CVE-2022-1894
The Popup Builder WordPress plugin prior to 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltred_html is disallowed
Sygnoos Popup Builder
4.3
CVSSv3
CVE-2022-32289
Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.
Sygnoos Popup Builder
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463
CVE-2024-29895
inject
CVE-2023-52689
CVE-2024-5049
CVE-2024-5051
privilege escalation
physical
CVE-2023-52676
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
NEXT »