Popup Maker Vulnerabilities

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.23.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVSS:

7.2

Affected:

up to 1.23.0

Fixed in:

1.24.0

Disclosed:

Aug 5, 2026

CVE-2026-28177 on NVD →

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possi...

CVSS:

7.2

Affected:

up to 1.22.0

Fixed in:

1.23.0

Disclosed:

Jul 8, 2026

CVE-2026-8848 on NVD →

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbi...

CVSS:

6.4

Affected:

up to 1.20.6

Fixed in:

1.21.0

Disclosed:

Sep 25, 2025

CVE-2025-9490 on NVD →

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ar...

CVSS:

6.4

Affected:

up to 1.20.4

Fixed in:

1.20.5

Disclosed:

Jun 2, 2025

CVE-2025-4205 on NVD →

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.20.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

6.4

Affected:

up to 1.20.2

Fixed in:

1.20.3

Disclosed:

Jan 24, 2025

CVE-2025-24746 on NVD →

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_title’ parameter in all versions up to, and including, 1.20.2 due to insufficient input sanitization and output escaping. This makes it poss...

CVSS:

5.4

Affected:

up to 1.20.2

Fixed in:

1.20.3

Disclosed:

Dec 11, 2024

CVE-2024-10583 on NVD →

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.19.2. This makes it possible for unauthenticated attackers to perform an u...

CVSS:

5.3

Affected:

up to 1.19.2

Fixed in:

1.20.0

Disclosed:

Sep 30, 2024

CVE-2024-47358 on NVD →

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘close_text’ parameter in all versions up to, and including, 1.19.0 due to insufficient input sanitization and output escaping. This makes it poss...

CVSS:

6.4

Affected:

up to 1.19.0

Fixed in:

1.19.1

Disclosed:

Aug 19, 2024

CVE-2024-7054 on NVD →

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.0 due to insufficient input sanitization and output escaping. This makes it possible for aut...

CVSS:

4.4

Affected:

up to 1.19.0

Fixed in:

1.19.1

Disclosed:

Aug 19, 2024

CVE-2024-5561 on NVD →

The Popup Maker – Popup for opt-ins, lead gen, & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentica...

CVSS:

6.4

Affected:

up to 1.18.2

Fixed in:

1.18.3

Disclosed:

Mar 20, 2024

CVE-2024-2336 on NVD →

The Popup Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.17.1 due to the fact that the plugin generates a predictable name when creating debug log files. This can allow unauthenticated attackers to view log files.

CVSS:

5.3

Affected:

up to 1.17.1

Fixed in:

1.18.0

Disclosed:

Mar 14, 2023

CVE-2022-47597 on NVD →

The Popup Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_popup_enabled_state function in versions up to, and including, 1.17.1. This makes it possible for authenticated attackers with contributor-level access, and above, to enable and disable...

CVSS:

5.4

Affected:

up to 1.17.1

Fixed in:

1.18.0

Disclosed:

Mar 9, 2023

CVE-2022-45819 on NVD →

The Popup Maker plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.18.0. This is due to missing or incorrect nonce validation on the 'init' function. This makes it possible for unauthenticated attackers to flush the popup cache via forged request granted they can trick...

CVSS:

4.3

Affected:

up to 1.18.0

Fixed in:

1.18.1

Disclosed:

Mar 8, 2023

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.16.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in p...

CVSS:

5.5

Affected:

up to 1.16.10

Fixed in:

1.16.11

Disclosed:

Oct 31, 2022

CVE-2022-3690 on NVD →

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup body content in versions up to, and including, 1.16.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject ar...

CVSS:

6.4

Affected:

up to 1.16.8

Fixed in:

1.16.9

Disclosed:

Sep 26, 2022

CVE-2022-4381 on NVD →

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.16.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and abo...

CVSS:

6.4

Affected:

up to 1.16.8

Fixed in:

1.16.9

Disclosed:

Sep 23, 2022

CVE-2022-4362 on NVD →

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Cookie Time field in versions up to, and including, 1.16.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative access to inject arbitrary web scripts i...

CVSS:

5.5

Affected:

up to 1.16.4

Fixed in:

1.16.5

Disclosed:

Apr 19, 2022

CVE-2022-1104 on NVD →

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text...

CVSS:

7.5

Affected:

up to 1.8.12

Fixed in:

1.8.13

Disclosed:

Oct 14, 2019

CVE-2019-17574 on NVD →

The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and...

CVSS:

8.8

Affected:

up to 1.8.3

Fixed in:

1.8.3

Disclosed:

Feb 25, 2019

Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS:

6.1

Affected:

up to 1.6.5

Fixed in:

1.6.5

Disclosed:

Jul 24, 2017

CVE-2017-2284 on NVD →