Popup Box Vulnerabilities

The Popup Box – Easily Create WordPress Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenti...

CVSS:

6.4

Affected:

up to 3.2.12

Fixed in:

3.2.13

Disclosed:

Feb 17, 2026

CVE-2025-12122 on NVD →

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a...

CVSS:

4.3

Affected:

up to 3.2.4

Fixed in:

3.2.5

Disclosed:

Jan 24, 2025

CVE-2025-24711 on NVD →

The Popup Box – new WordPress popup plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.6. This is due to missing or incorrect nonce validation on the popup-box page. This makes it possible for unauthenticated attackers to delete pop-ups via a forged request...

CVSS:

4.3

Affected:

up to 2.2.6

Fixed in:

2.2.7

Disclosed:

Apr 11, 2024

CVE-2024-3477 on NVD →

Several plugins by Wow-Company are vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri...

CVSS:

6.1

Affected:

up to 2.2.1

Fixed in:

2.2.2

Disclosed:

May 22, 2023

CVE-2023-2362 on NVD →

Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.

CVSS:

6.8

Affected:

up to 2.1.2

Fixed in:

2.2

Disclosed:

May 17, 2022

CVE-2022-29445 on NVD →