Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
medium
The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to in...
- CVSS:
- 6.4
(Wordfence)
- Affected:
- up to 1.2.3
- Fixed in:
- 1.2.4
- Disclosed:
- Sep 15, 2026
CVE-2026-11996 on NVD →
Advanced Popups <= 1.1.1 - Cross-Site Request Forgery Bypass
medium
The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the metabox_popup_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted the...
- CVSS:
- 4.3
(Wordfence)
- Affected:
- up to 1.1.1
- Fixed in:
- 1.1.2
- Disclosed:
- Jun 21, 2020
CVE-2021-4421 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database