Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 6 vulnerability records associated with Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

6Total records
1Critical
0High
5Medium
0Low
0Informational
6Patched records
0Currently marked unpatched
2021-10-25First disclosure
2026-04-09Latest disclosure
6 of 6CVE coverage

Use this history

Check and watch Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed versionWatch Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions

Year-by-Year Timeline

YearRecordsRelative volume
202111 records
202211 records
202322 records
202411 records
202611 records

Severity Breakdown

SeverityRecordsShare
Critical116.7%
Medium583.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

2 records33.3%

First: 2021. Latest: 2022.

Missing Authorization

2 records33.3%

First: 2023. Latest: 2024.

CSRF

1 record16.7%

First: 2023. Latest: 2023.

Other

1 record16.7%

First: 2026. Latest: 2026.

Patch Status

Patched
6
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 2.9.1.1
  • 2.8.1
  • 2.8
  • 2.2.2
  • 2.1.7
  • 2.0.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
2.9.1Essentialplugin Plugins (Various Versions) - Injected BackdoorApril 9, 20262.9.1.1Critical
*-2.8.0Popup Anything <= 2.8.0 - Missing AuthorizationApril 16, 20242.8.1Medium
*-2.7Multiple WPOnlineSupport Plugins <= (Various Versions) - Missing Authorization to Notice DismissalAugust 16, 20232.8Medium
[*, 2.2.2)WP OnlineSupport, Essential Plugin Popup Anything <= 2.2.1 - Cross Site Request ForgeryMarch 28, 20232.2.2Medium
*-2.1.6Popup Anything – A Marketing Popup and Lead Generation Conversions <= 2.1.6 - Reflected Cross-Site ScriptingJuly 4, 20222.1.7Medium
*-2.0.3Popup Anything <= 2.0.3 - Contributor+ Stored Cross-Site ScriptingOctober 25, 20212.0.4Medium

Selected source records

Latest Records

CriticalCVE-2026-6443

Essentialplugin Plugins (Various Versions) - Injected Backdoor

Published: April 9, 2026

Affected versions
1.5.6
Patched versions
1.5.6.1
Affected versions
2.8.7
Patched versions
2.8.7.1
Affected versions
3.5.6
Patched versions
3.5.6.1
Affected versions
3.7.8.1
Patched versions
3.7.8.2
Affected versions
1.4.6
Patched versions
1.4.6.1
Affected versions
3.8.7
Patched versions
3.8.7.1
Affected versions
2.1.8
Patched versions
2.1.8.1
Affected versions
2.0.8
Patched versions
2.0.8.1
Affected versions
2.7.7
Patched versions
2.7.7.1
Affected versions
5.0.6
Patched versions
5.0.6.1
Affected versions
1.8.6
Patched versions
1.8.6.1
Affected versions
2.6.9
Patched versions
2.6.9.1
Affected versions
1.7.6
Patched versions
1.7.6.1
Affected versions
1.7.6
Patched versions
1.7.6.1
Affected versions
2.8.6
Patched versions
2.8.6.1
Affected versions
1.7.4
Patched versions
1.7.4.1
Affected versions
2.6.6
Patched versions
2.6.6.1
Affected versions
1.5.7
Patched versions
1.5.7.1
Affected versions
2.4.5
Patched versions
2.4.5.1
Affected versions
2.9.1
Patched versions
2.9.1.1
Affected versions
3.9.5
Patched versions
3.9.5.1
Affected versions
3.7.1
Patched versions
3.7.1.1
Original Wordfence record
MediumCVE-2024-32601

Popup Anything <= 2.8.0 - Missing Authorization

Published: April 16, 2024

Affected versions
*-2.8.0
Patched versions
2.8.1
Original Wordfence record
MediumCVE-2023-40200

Multiple WPOnlineSupport Plugins <= (Various Versions) - Missing Authorization to Notice Dismissal

Published: August 16, 2023

Affected versions
*-1.3.7
Patched versions
1.3.8
Affected versions
*-2.6.5
Patched versions
2.6.6
Affected versions
*-3.3
Patched versions
3.3.1
Affected versions
*-3.5
Patched versions
3.6
Affected versions
*-1.2.4
Patched versions
1.2.5
Affected versions
*-3.6
Patched versions
3.7
Affected versions
*-1.7
Patched versions
1.7.1
Affected versions
*-1.8.2
Patched versions
1.8.3
Affected versions
*-2.5.1
Patched versions
2.5.2
Affected versions
*-4.8
Patched versions
4.9
Affected versions
*-1.6
Patched versions
1.6.1
Affected versions
*-2.4
Patched versions
2.4.1
Affected versions
*-1.6
Patched versions
1.7
Affected versions
*-1.5.5
Patched versions
1.5.6
Affected versions
*-2.6
Patched versions
2.6.1
Affected versions
*-1.5.2
Patched versions
1.5.3
Affected versions
*-2.5
Patched versions
2.6
Affected versions
*-1.4
Patched versions
1.5
Affected versions
*-2.1
Patched versions
2.1.1
Affected versions
*-2.7
Patched versions
2.8
Affected versions
*-3.8
Patched versions
3.9
Affected versions
*-3.4
Patched versions
3.5
Original Wordfence record
MediumCVE-2022-38077

WP OnlineSupport, Essential Plugin Popup Anything <= 2.2.1 - Cross Site Request Forgery

Published: March 28, 2023

Affected versions
[*, 2.2.2)
Patched versions
2.2.2
Original Wordfence record
MediumCVE-2022-2115

Popup Anything – A Marketing Popup and Lead Generation Conversions <= 2.1.6 - Reflected Cross-Site Scripting

Published: July 4, 2022

Affected versions
*-2.1.6
Patched versions
2.1.7
Original Wordfence record
MediumCVE-2021-24883

Popup Anything <= 2.0.3 - Contributor+ Stored Cross-Site Scripting

Published: October 25, 2021

Affected versions
*-2.0.3
Patched versions
2.0.4
Original Wordfence record

Highest-Severity Records

CriticalCVE-2026-6443

Essentialplugin Plugins (Various Versions) - Injected Backdoor

Published: April 9, 2026

Affected versions
1.5.6
Patched versions
1.5.6.1
Affected versions
2.8.7
Patched versions
2.8.7.1
Affected versions
3.5.6
Patched versions
3.5.6.1
Affected versions
3.7.8.1
Patched versions
3.7.8.2
Affected versions
1.4.6
Patched versions
1.4.6.1
Affected versions
3.8.7
Patched versions
3.8.7.1
Affected versions
2.1.8
Patched versions
2.1.8.1
Affected versions
2.0.8
Patched versions
2.0.8.1
Affected versions
2.7.7
Patched versions
2.7.7.1
Affected versions
5.0.6
Patched versions
5.0.6.1
Affected versions
1.8.6
Patched versions
1.8.6.1
Affected versions
2.6.9
Patched versions
2.6.9.1
Affected versions
1.7.6
Patched versions
1.7.6.1
Affected versions
1.7.6
Patched versions
1.7.6.1
Affected versions
2.8.6
Patched versions
2.8.6.1
Affected versions
1.7.4
Patched versions
1.7.4.1
Affected versions
2.6.6
Patched versions
2.6.6.1
Affected versions
1.5.7
Patched versions
1.5.7.1
Affected versions
2.4.5
Patched versions
2.4.5.1
Affected versions
2.9.1
Patched versions
2.9.1.1
Affected versions
3.9.5
Patched versions
3.9.5.1
Affected versions
3.7.1
Patched versions
3.7.1.1
Original Wordfence record
MediumCVE-2022-2115

Popup Anything – A Marketing Popup and Lead Generation Conversions <= 2.1.6 - Reflected Cross-Site Scripting

Published: July 4, 2022

Affected versions
*-2.1.6
Patched versions
2.1.7
Original Wordfence record
MediumCVE-2021-24883

Popup Anything <= 2.0.3 - Contributor+ Stored Cross-Site Scripting

Published: October 25, 2021

Affected versions
*-2.0.3
Patched versions
2.0.4
Original Wordfence record
MediumCVE-2024-32601

Popup Anything <= 2.8.0 - Missing Authorization

Published: April 16, 2024

Affected versions
*-2.8.0
Patched versions
2.8.1
Original Wordfence record
MediumCVE-2023-40200

Multiple WPOnlineSupport Plugins <= (Various Versions) - Missing Authorization to Notice Dismissal

Published: August 16, 2023

Affected versions
*-1.3.7
Patched versions
1.3.8
Affected versions
*-2.6.5
Patched versions
2.6.6
Affected versions
*-3.3
Patched versions
3.3.1
Affected versions
*-3.5
Patched versions
3.6
Affected versions
*-1.2.4
Patched versions
1.2.5
Affected versions
*-3.6
Patched versions
3.7
Affected versions
*-1.7
Patched versions
1.7.1
Affected versions
*-1.8.2
Patched versions
1.8.3
Affected versions
*-2.5.1
Patched versions
2.5.2
Affected versions
*-4.8
Patched versions
4.9
Affected versions
*-1.6
Patched versions
1.6.1
Affected versions
*-2.4
Patched versions
2.4.1
Affected versions
*-1.6
Patched versions
1.7
Affected versions
*-1.5.5
Patched versions
1.5.6
Affected versions
*-2.6
Patched versions
2.6.1
Affected versions
*-1.5.2
Patched versions
1.5.3
Affected versions
*-2.5
Patched versions
2.6
Affected versions
*-1.4
Patched versions
1.5
Affected versions
*-2.1
Patched versions
2.1.1
Affected versions
*-2.7
Patched versions
2.8
Affected versions
*-3.8
Patched versions
3.9
Affected versions
*-3.4
Patched versions
3.5
Original Wordfence record
MediumCVE-2022-38077

WP OnlineSupport, Essential Plugin Popup Anything <= 2.2.1 - Cross Site Request Forgery

Published: March 28, 2023

Affected versions
[*, 2.2.2)
Patched versions
2.2.2
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory