Sygnoos: >> Popup Builder >> 3.68.3 Security Vulnerabilities
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
CVSS Score
9.8
EPSS Score
0.623
Published
2022-03-28
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
CVSS Score
7.2
EPSS Score
0.07
Published
2022-02-21
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
CVSS Score
8.8
EPSS Score
0.009
Published
2022-02-21
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.
CVSS Score
6.1
EPSS Score
0.002
Published
2021-04-05
Page 2