Ays Facebook Popup Likebox Vulnerabilities

[en] Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Like box: from n/a through <= 3.7.7.

Affected:

up to 3.7.7

Fix:

No patched version reported

Disclosed:

Mar 13, 2026

CVE-2026-32428 on NVD →

The Popup Like box plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.7.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.7.7

Fixed in:

3.7.8

Disclosed:

Mar 1, 2026

CVE-2026-32428 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup LikeBox Team Popup Like box allows Stored XSS.This issue affects Popup Like box: from n/a through 3.7.2.

Affected:

up to 3.7.3

Fixed in:

3.7.3

Disclosed:

Apr 11, 2024

CVE-2024-31387 on NVD →

The Popup Like box – Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above...

CVSS:

4.4

Affected:

up to 3.7.2

Fixed in:

3.7.3

Disclosed:

Apr 10, 2024

CVE-2024-31387 on NVD →

[en] The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

Affected:

up to 3.6.1

Fixed in:

3.6.1

Disclosed:

Mar 28, 2022

CVE-2022-0641 on NVD →

The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

CVSS:

6.1

Affected:

up to 3.6.1

Fixed in:

3.6.1

Disclosed:

Mar 7, 2022

CVE-2022-0641 on NVD →

[en] The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

Affected:

up to 3.5.3

Fixed in:

3.5.3

Disclosed:

Aug 2, 2021

CVE-2021-24460 on NVD →

The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS:

8.8

Affected:

up to 3.5.2

Fixed in:

3.5.3

Disclosed:

Jun 29, 2021

CVE-2021-24460 on NVD →

The "Popup Like box – Page Plugin" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.1

Affected:

up to 3.5.2

Fixed in:

3.5.3

Disclosed:

Jun 29, 2021

The "Popup Like box – Page Plugin" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

Affected:

up to 3.5.3

Fixed in:

3.5.3

Disclosed:

Jun 29, 2021

The plugins did not properly sanitise and escape some GET parameters before outputting them back in attributes, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in administrator

Affected:

up to 3.5.3

Fixed in:

3.5.3