Cross-Site Scripting
9 records39.1%First: 2020. Latest: 2025.
Plugin security history
Popup Builder – Create highly converting, mobile friendly marketing popups. Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 23 vulnerability records associated with Popup Builder – Create highly converting, mobile friendly marketing popups., published between 2019 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
23Total records
3Critical
6High
14Medium
0Low
0Informational
23Patched records
0Currently marked unpatched
2019-08-06First disclosure
2026-02-18Latest disclosure
22 of 23CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2019 | 1 | |
| 2020 | 3 | |
| 2021 | 2 | |
| 2022 | 6 | |
| 2023 | 2 | |
| 2024 | 7 | |
| 2025 | 1 | |
| 2026 | 1 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 3 | 13% |
| High | 6 | 26.1% |
| Medium | 14 | 60.9% |
Vulnerability-Type Breakdown
Other
4 records17.4%First: 2020. Latest: 2026.
SQL Injection
3 records13%First: 2019. Latest: 2022.
Missing Authorization
3 records13%First: 2021. Latest: 2024.
Information Disclosure
2 records8.7%First: 2020. Latest: 2024.
CSRF
2 records8.7%First: 2022. Latest: 2022.
Patch Status
- Patched
- 23
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
4.4.34.4.24.3.54.3.74.3.24.3.04.2.74.2.64.2.34.2.24.1.124.1.114.1.14.0.73.743.723.64.13.03.45
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-4.4.2 | Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens | February 18, 2026 | 4.4.3 | Medium |
*-4.4.1 | Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | December 12, 2025 | 4.4.2 | Medium |
*-4.3.4 | Popup Builder <= 4.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting | November 21, 2024 | 4.3.5 | Medium |
*-4.3.6 | Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File | August 28, 2024 | 4.3.7 | Medium |
*-4.3.1 | Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure | June 14, 2024 | 4.3.2 | High |
*-4.3.0 | Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions | June 14, 2024 | 4.3.2 | High |
*-4.2.7 | Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS | May 31, 2024 | 4.3.0 | Medium |
*-4.2.6 | Popup Builder <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | March 25, 2024 | 4.2.7 | Medium |
*-4.2.5 | Popup Builder <= 4.2.5 - Authenticated (Admin+) Server-Side Request Forgery | January 17, 2024 | 4.2.6 | Medium |
[*, 4.2.3) | Popup Builder <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting | December 11, 2023 | 4.2.3 | Medium |
*-4.2.1 | Popup Builder <= 4.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting | August 28, 2023 | 4.2.2 | Medium |
*-4.1.11 | Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.1.11 - Cross-Site Request Forgery to Settings Update | June 30, 2022 | 4.1.12 | High |
*-4.1.10 | Popup Builder <= 4.1.10 - Authenticated (Admin+) Cross-Site Scripting | June 20, 2022 | 4.1.11 | Medium |
*-4.1.0 | Popup Builder <= 4.1.0 - Cross-Site Request Forgery | June 17, 2022 | 4.1.11 | Medium |
[*, 4.1.1) | Popup Builder <= 4.1.0 - SQL Injection | March 7, 2022 | 4.1.1 | Critical |
[*, 4.0.7) | Popup Builder <= 4.0.6 - Local File Inclusion and PHAR Deserialization | January 24, 2022 | 4.0.7 | High |
[*, 4.0.7) | Popup Builder <= 4.0.6 - Authenticated SQL Injection via order & orderby Parameters | January 24, 2022 | 4.0.7 | High |
*-3.73 | Popup Builder <= 3.73 - Reflected Cross-Site Scripting | February 2, 2021 | 3.74 | Medium |
*-3.71 | Popup Builder <= 3.72 Missing Authorization on AJAX actions | January 28, 2021 | 3.72 | Medium |
*-3.63 | Popup Builder <= 3.63 - Authenticated Settings Modification, Configuration Disclosure, and User Data Export | March 12, 2020 | 3.64.1 | Medium |
*-3.63 | Popup Builder <= 3.63 - Unauthenticated Stored Cross-Site Scripting | March 12, 2020 | 3.64.1 | High |
2.2.8-2.6.7.6 | Popup Builder 2.2.8 - 2.6.7.6 - PHP Object Injection | February 16, 2020 | 3.0 | Critical |
*-3.44 | Popup Builder <= 3.44 - SQL Injection | August 6, 2019 | 3.45 | Critical |
Selected source records
Latest Records
MediumCVE-2025-13079
Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens
Published: February 18, 2026
- Affected versions
- *-4.4.2
- Patched versions
- 4.4.3
MediumCVE-2025-9856
Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: December 12, 2025
- Affected versions
- *-4.4.1
- Patched versions
- 4.4.2
MediumCVE-2024-9428
Popup Builder <= 4.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Published: November 21, 2024
- Affected versions
- *-4.3.4
- Patched versions
- 4.3.5
MediumCVE-2024-2541
Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File
Published: August 28, 2024
- Affected versions
- *-4.3.6
- Patched versions
- 4.3.7
HighCVE-2024-2544
Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions
Published: June 14, 2024
- Affected versions
- *-4.3.0
- Patched versions
- 4.3.2
HighCVE-2023-6696
Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure
Published: June 14, 2024
- Affected versions
- *-4.3.1
- Patched versions
- 4.3.2
MediumCVE-2024-2506
Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS
Published: May 31, 2024
- Affected versions
- *-4.2.7
- Patched versions
- 4.3.0
MediumCVE-2024-30184
Popup Builder <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published: March 25, 2024
- Affected versions
- *-4.2.6
- Patched versions
- 4.2.7
Highest-Severity Records
CriticalCVE-2020-9006
Popup Builder 2.2.8 - 2.6.7.6 - PHP Object Injection
Published: February 16, 2020
- Affected versions
- 2.2.8-2.6.7.6
- Patched versions
- 3.0
CriticalCVE-2022-0479
Popup Builder <= 4.1.0 - SQL Injection
Published: March 7, 2022
- Affected versions
- [*, 4.1.1)
- Patched versions
- 4.1.1
CriticalCVE-2019-14695
Popup Builder <= 3.44 - SQL Injection
Published: August 6, 2019
- Affected versions
- *-3.44
- Patched versions
- 3.45
HighCVE-2021-25082
Popup Builder <= 4.0.6 - Local File Inclusion and PHAR Deserialization
Published: January 24, 2022
- Affected versions
- [*, 4.0.7)
- Patched versions
- 4.0.7
HighCVE-2022-29495
Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.1.11 - Cross-Site Request Forgery to Settings Update
Published: June 30, 2022
- Affected versions
- *-4.1.11
- Patched versions
- 4.1.12
HighCVE-2020-10196
Popup Builder <= 3.63 - Unauthenticated Stored Cross-Site Scripting
Published: March 12, 2020
- Affected versions
- *-3.63
- Patched versions
- 3.64.1
HighCVE-2023-6696
Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure
Published: June 14, 2024
- Affected versions
- *-4.3.1
- Patched versions
- 4.3.2
HighCVE-2024-2544
Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions
Published: June 14, 2024
- Affected versions
- *-4.3.0
- Patched versions
- 4.3.2
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.