Ays Popup Box Vulnerabilities

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authentica...

CVSS:

4.9

Affected:

up to 6.0.1

Fixed in:

6.0.2

Disclosed:

Jun 26, 2026

CVE-2026-57631 on NVD →

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVSS:

6.1

Affected:

up to 6.2.9

Fixed in:

6.3.0

Disclosed:

Jun 16, 2026

CVE-2026-54192 on NVD →

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 5.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wi...

CVSS:

7.2

Affected:

up to 5.5.0

Fixed in:

5.5.0

Disclosed:

Apr 8, 2026

CVE-2025-15611 on NVD →

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for un...

CVSS:

4.3

Affected:

up to 6.1.1

Fixed in:

6.1.2

Disclosed:

Jan 30, 2026

CVE-2026-1165 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.

Affected:

up to 6.0.7

Fix:

No patched version reported

Disclosed:

Dec 30, 2025

CVE-2025-69021 on NVD →

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauth...

CVSS:

4.3

Affected:

up to 6.0.7

Fixed in:

6.0.8

Disclosed:

Dec 28, 2025

CVE-2025-69021 on NVD →

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauth...

CVSS:

4.3

Affected:

up to 5.5.4

Fixed in:

5.5.5

Disclosed:

Oct 29, 2025

CVE-2025-57931 on NVD →

[en] The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers...

Affected:

up to 4.9.8

Fixed in:

4.9.8

Disclosed:

Nov 16, 2024

CVE-2024-10861 on NVD →

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to u...

CVSS:

5.3

Affected:

up to 4.9.7

Fixed in:

4.9.8

Disclosed:

Nov 15, 2024

CVE-2024-10861 on NVD →

[en] Missing Authorization vulnerability in Popup Box Team Popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup box: from n/a through 4.5.1.

Affected:

up to 4.5.2

Fixed in:

4.5.2

Disclosed:

Nov 1, 2024

CVE-2024-37096 on NVD →

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin...

CVSS:

4.4

Affected:

up to 4.7.7

Fixed in:

4.7.8

Disclosed:

Oct 31, 2024

CVE-2024-9599 on NVD →

The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perfo...

CVSS:

4.3

Affected:

up to 4.5.1

Fixed in:

4.5.2

Disclosed:

Jun 20, 2024

CVE-2024-37096 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4.1.2.

Affected:

up to 4.1.3

Fixed in:

4.1.3

Disclosed:

May 6, 2024

CVE-2024-34367 on NVD →

The Popup box plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a s...

CVSS:

6.1

Affected:

up to 4.1.2

Fixed in:

4.1.3

Disclosed:

May 3, 2024

CVE-2024-34367 on NVD →

[en] The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registere...

Affected:

up to 4.3.7

Fixed in:

4.3.7

Disclosed:

May 2, 2024

CVE-2024-3897 on NVD →

The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on...

CVSS:

5.3

Affected:

up to 4.3.6

Fixed in:

4.3.7

Disclosed:

Apr 24, 2024

CVE-2024-3897 on NVD →

[en] The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 3.9.0

Fixed in:

3.9.0

Disclosed:

Feb 12, 2024

CVE-2023-6591 on NVD →

The Popup Box Business and Developer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 20.0.0 to 20.9.0 (Developer) and versions 7.0.0 to 7.9.0 (Business) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with a...

CVSS:

6.6

Affected:

7.0.0 – 7.9.0

Fixed in:

7.9.0

Disclosed:

Jan 22, 2024

CVE-2023-6591 on NVD →

[en] The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 3.8.6

Fixed in:

3.8.6

Disclosed:

Dec 4, 2023

CVE-2023-5809 on NVD →

[en] The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 3.8.6

Fixed in:

3.8.6

Disclosed:

Dec 4, 2023

CVE-2023-5874 on NVD →

[en] The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Affected:

up to 3.7.9

Fixed in:

3.7.9

Disclosed:

Nov 20, 2023

CVE-2023-5343 on NVD →

The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 3.8.7 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

CVSS:

4.4

Affected:

up to 3.8.7

Fixed in:

3.8.7

Disclosed:

Nov 13, 2023

CVE-2023-5809 on NVD →

The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 3.8.7 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

CVSS:

4.4

Affected:

up to 3.8.7

Fixed in:

3.8.7

Disclosed:

Nov 13, 2023

CVE-2023-5874 on NVD →

The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 3.8.7 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

Affected:

up to 3.8.7

Fixed in:

3.8.7

Disclosed:

Nov 13, 2023

[en] The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Affected:

up to 3.7.2

Fixed in:

3.7.2

Disclosed:

Oct 31, 2023

CVE-2023-4390 on NVD →

The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission...

CVSS:

4.4

Affected:

up to 3.7.8

Fixed in:

3.7.9

Disclosed:

Oct 27, 2023

CVE-2023-5343 on NVD →

Update the WordPress Popup box plugin to the latest available version (at least 3.7.2). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Popup box Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads...

Affected:

up to 3.7.2

Fixed in:

3.7.2

Disclosed:

Aug 31, 2023

The Popup Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary w...

CVSS:

4.4

Affected:

up to 3.7.2

Fixed in:

3.7.2

Disclosed:

Aug 29, 2023

CVE-2023-4390 on NVD →

The Popup Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary w...

Affected:

up to 3.7.2

Fixed in:

3.7.2

Disclosed:

Aug 29, 2023

The Popup Box plugin is for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_html’ parameter in versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to in...

CVSS:

4.4

Affected:

up to 3.7.1

Fixed in:

3.7.1

Disclosed:

Aug 18, 2023

The Popup Box plugin is for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_html’ parameter in versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to in...

Affected:

up to 3.7.1

Fixed in:

3.7.1

Disclosed:

Aug 18, 2023

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin <= 3.4.4 versions.

Affected:

up to 3.4.5

Fixed in:

3.4.5

Disclosed:

Jun 21, 2023

CVE-2023-27414 on NVD →

The Popup box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ays_pb_tab' parameter in versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex...

CVSS:

5.4

Affected:

up to 3.4.4

Fixed in:

3.4.5

Disclosed:

Mar 8, 2023

CVE-2023-27414 on NVD →

[en] The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

Affected:

up to 2.3.4

Fixed in:

2.3.4

Disclosed:

Aug 2, 2021

CVE-2021-24458 on NVD →

The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard.

CVSS:

8.8

Affected:

up to 2.3.4

Fixed in:

2.3.4

Disclosed:

Jun 29, 2021

CVE-2021-24458 on NVD →

The Popup box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they...

CVSS:

6.1

Affected:

up to 2.3.3

Fixed in:

2.3.4

Disclosed:

Jun 29, 2021

The Popup box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they...

Affected:

up to 2.3.4

Fixed in:

2.3.4

Disclosed:

Jun 29, 2021

The plugins did not properly sanitise and escape some GET parameters before outputting them back in attributes, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in administrator

Affected:

up to 2.3.4

Fixed in:

2.3.4

Affected:

up to 4.7.8

Fixed in:

4.7.8

CVE-2024-9599 on NVD →