Popup Anything On Click Vulnerabilities

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and injec...

CVSS:

9.8

Affected:

2.9.1 – 2.9.1

Fixed in:

2.9.1.1

Disclosed:

Apr 9, 2026

CVE-2026-6443 on NVD →

[en] Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Popup Anything.This issue affects Popup Anything: from n/a through 2.8.

Affected:

up to 2.8.1

Fixed in:

2.8.1

Disclosed:

Apr 18, 2024

CVE-2024-32601 on NVD →

The Popup Anything – Popup for opt-ins and Lead Generation Conversions plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the popupaoc_render_popup_preview() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to...

CVSS:

5.3

Affected:

up to 2.8.0

Fixed in:

2.8.1

Disclosed:

Apr 16, 2024

CVE-2024-32601 on NVD →

Multiple WPOnlineSupport plugins for WordPress are vulnerable to unauthorized modification of data due to a missing capability check on the wpos_anylc_admin_init_process() function hooked via admin_init in various versions. This makes it possible for unauthenticated attackers to dismiss a license notice.

CVSS:

5.3

Affected:

up to 2.7

Fixed in:

2.8

Disclosed:

Aug 16, 2023

CVE-2023-40200 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.

Affected:

up to 2.2.2

Fixed in:

2.2.2

Disclosed:

Mar 29, 2023

CVE-2022-38077 on NVD →

The WP OnlineSupport, Essential Plugin Popup Anything plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.1. This is due to missing nonce validation on the popupaoc_register_settings() function. This makes it possible for unauthenticated attackers to reset the plugin's...

CVSS:

4.3

Affected:

up to 2.2.2

Fixed in:

2.2.2

Disclosed:

Mar 28, 2023

CVE-2022-38077 on NVD →

[en] The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting

Affected:

up to 2.1.7

Fixed in:

2.1.7

Disclosed:

Jul 25, 2022

CVE-2022-2115 on NVD →

The Popup Anything – A Marketing Popup and Lead Generation Conversions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a custom key parameter in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVSS:

6.1

Affected:

up to 2.1.6

Fixed in:

2.1.7

Disclosed:

Jul 4, 2022

CVE-2022-2115 on NVD →

[en] The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

Affected:

up to 2.0.4

Fixed in:

2.0.4

Disclosed:

Nov 29, 2021

CVE-2021-24883 on NVD →

The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

CVSS:

5.4

Affected:

up to 2.0.3

Fixed in:

2.0.4

Disclosed:

Oct 25, 2021

CVE-2021-24883 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 2.8

Fixed in:

2.8

CVE-2023-40200 on NVD →