Plugin security history

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 19 vulnerability records associated with Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder, published between 2017 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

19Total records

0Critical

3High

16Medium

0Low

0Informational

19Patched records

0Currently marked unpatched

2017-07-24First disclosure

2026-07-08Latest disclosure

17 of 19CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2017	1	1 records
2019	2	2 records
2022	4	4 records
2023	3	3 records
2024	5	5 records
2025	3	3 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	3	15.8%
Medium	16	84.2%

Vulnerability-Type Breakdown

Cross-Site Scripting

12 records63.2%

First: 2017. Latest: 2025.

Missing Authorization

4 records21.1%

First: 2019. Latest: 2026.

Authentication Bypass

1 record5.3%

First: 2019. Latest: 2019.

CSRF

1 record5.3%

First: 2023. Latest: 2023.

Information Disclosure

1 record5.3%

First: 2023. Latest: 2023.

Patch Status

Patched: 19
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.23.0
1.21.0
1.20.5
1.20.3
1.20.0
1.19.1
1.18.3
1.18.0
1.18.1
1.16.11
1.16.9
1.16.5
1.8.13
1.8.3
1.6.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.22.0`	Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation	July 8, 2026	1.23.0	High
`*-1.20.6`	Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter	September 25, 2025	1.21.0	Medium
`*-1.20.4`	Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter	June 2, 2025	1.20.5	Medium
`*-1.20.2`	Popup Maker <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 24, 2025	1.20.3	Medium
`*-1.20.2`	Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 11, 2024	1.20.3	Medium
`*-1.19.2`	Popup Maker <= 1.19.2 - Missing Authorization	September 30, 2024	1.20.0	Medium
`*-1.19.0`	Popup Maker <= 1.19.0 - Authenticated (Admin+) Stored Cross-Site Scripting	August 19, 2024	1.19.1	Medium
`*-1.19.0`	Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 19, 2024	1.19.1	Medium
`*-1.18.2`	Popup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 20, 2024	1.18.3	Medium
`*-1.17.1`	Popup Maker <= 1.17.1 - Sensitive Data Exposure via debug log file	March 14, 2023	1.18.0	Medium
`*-1.17.1`	Popup Maker <= 1.17.1 - Missing Authorization via save_popup_enabled_state	March 9, 2023	1.18.0	Medium
`*-1.18.0`	Popup Maker <= 1.18.0 - Cross-Site Request Forgery via init	March 8, 2023	1.18.1	Medium
`*-1.16.10`	Popup Maker <= 1.16.10 - Authenticated (Administrator+) Stored Cross-Site Scripting	October 31, 2022	1.16.11	Medium
`*-1.16.8`	Popup Maker <= 1.16.8 - Authenticated (Contributor+) Cross-Site Scripting	September 26, 2022	1.16.9	Medium
`*-1.16.8`	Popup Maker <= 1.16.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	September 23, 2022	1.16.9	Medium
`*-1.16.4`	Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scripting	April 19, 2022	1.16.5	Medium
`*-1.8.12`	Popup-Maker <= 1.8.12 - Unauthenticated information disclosure	October 14, 2019	1.8.13	High
`[*, 1.8.3)`	Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update	February 25, 2019	1.8.3	High
`[*, 1.6.5)`	Popup Maker < 1.6.5 - Reflected Cross-Site Scripting	July 24, 2017	1.6.5	Medium

Selected source records

Latest Records

HighCVE-2026-8848

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation

Published: July 8, 2026

Affected versions: *-1.22.0
Patched versions: 1.23.0

Original Wordfence record

MediumCVE-2025-9490

Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter

Published: September 25, 2025

Affected versions: *-1.20.6
Patched versions: 1.21.0

Original Wordfence record

MediumCVE-2025-4205

Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter

Published: June 2, 2025

Affected versions: *-1.20.4
Patched versions: 1.20.5

Original Wordfence record

MediumCVE-2025-24746

Popup Maker <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 24, 2025

Affected versions: *-1.20.2
Patched versions: 1.20.3

Original Wordfence record

MediumCVE-2024-10583

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 11, 2024

Affected versions: *-1.20.2
Patched versions: 1.20.3

Original Wordfence record

MediumCVE-2024-47358

Popup Maker <= 1.19.2 - Missing Authorization

Published: September 30, 2024

Affected versions: *-1.19.2
Patched versions: 1.20.0

Original Wordfence record

MediumCVE-2024-7054

Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: August 19, 2024

Affected versions: *-1.19.0
Patched versions: 1.19.1

Original Wordfence record

MediumCVE-2024-5561

Popup Maker <= 1.19.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: August 19, 2024

Affected versions: *-1.19.0
Patched versions: 1.19.1

Original Wordfence record

Highest-Severity Records

High

Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update

Published: February 25, 2019

Affected versions: [*, 1.9.3)
Patched versions: 1.9.3

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: *-0.1.9
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: [*, 1.1.4)
Patched versions: 1.1.4

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: [*, 1.6.5)
Patched versions: 1.6.5

Affected versions: *-1.0.3
Patched versions: Not supplied

Affected versions: *-0.3
Patched versions: Not supplied

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.2.3
Patched versions: Not supplied

Affected versions: *-1.3.2
Patched versions: Not supplied

Affected versions: *-1.0.17
Patched versions: Not supplied

Affected versions: [*, 1.8.3)
Patched versions: 1.8.3

Affected versions: [*, 2.6)
Patched versions: 2.6

Affected versions: *-2.1
Patched versions: Not supplied

Affected versions: [*, 1.2.9)
Patched versions: 1.2.9

Affected versions: [*, 1.2.6)
Patched versions: 1.2.6

Affected versions: *-1.1.7
Patched versions: Not supplied

Affected versions: [*, 2.18.0)
Patched versions: 2.18.0

Affected versions: [*, 1.3.1)
Patched versions: 1.3.1

Affected versions: *-1.1.6
Patched versions: Not supplied

Affected versions: *-1.2.2
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: [*, 2.3.2)
Patched versions: 2.3.2

Affected versions: *-3.1
Patched versions: Not supplied

Affected versions: [*, 1.1.3)
Patched versions: 1.1.3

Affected versions: [*, 2.0.1)
Patched versions: 2.0.1

Affected versions: [*, 1.6.3)
Patched versions: 1.6.3

Affected versions: *-0.4.0
Patched versions: Not supplied

Affected versions: *-1.2.2
Patched versions: Not supplied

Affected versions: *-1.0.4
Patched versions: Not supplied

Affected versions: *-1.1.0
Patched versions: Not supplied

Affected versions: [*, 0.7.3)
Patched versions: 0.7.3

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.2.2
Patched versions: Not supplied

Affected versions: *-1.2.0
Patched versions: Not supplied

Affected versions: [*, 1.4.0)
Patched versions: 1.4.0

Affected versions: *-1.1.1
Patched versions: Not supplied

Affected versions: [*, 1.6.17)
Patched versions: 1.6.17

Affected versions: [*, 1.3.20)
Patched versions: 1.3.20

Affected versions: [*, 3.0.4)
Patched versions: 3.0.4

Affected versions: *-1.1.2
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: [*, 1.0.2)
Patched versions: 1.0.2

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.0.6
Patched versions: Not supplied

Affected versions: *-1.1.2
Patched versions: Not supplied

Affected versions: *-2.1
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.9.4
Patched versions: Not supplied

Affected versions: [*, 1.2.3)
Patched versions: 1.2.3

Affected versions: *-2.0.0
Patched versions: Not supplied

Affected versions: *-1.7.2
Patched versions: Not supplied

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: *-1.5.5
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-0.0.19
Patched versions: Not supplied

Affected versions: *-1.0.2
Patched versions: Not supplied

Affected versions: *-1.0.5
Patched versions: Not supplied

Affected versions: [*, 3.8.1)
Patched versions: 3.8.1

Affected versions: *-1.0.7
Patched versions: Not supplied

Affected versions: *-1.0.3
Patched versions: Not supplied

Affected versions: *-1.0.2
Patched versions: Not supplied

Affected versions: [*, 3.2.6.1)
Patched versions: 3.2.6.1

Affected versions: *-1.0.41
Patched versions: Not supplied

Affected versions: [*, 2.1.9.8)
Patched versions: 2.1.9.8

Affected versions: *-1.5.9.4
Patched versions: Not supplied

Affected versions: [*, 4.2997)
Patched versions: 4.2997

Affected versions: *-1.1.0
Patched versions: Not supplied

Affected versions: [*, 3.3.1.2)
Patched versions: 3.3.1.2

Affected versions: *-5.0
Patched versions: Not supplied

Affected versions: [*, 1.4.3)
Patched versions: 1.4.3

Affected versions: *-2.0
Patched versions: Not supplied

Affected versions: *-2.0.0
Patched versions: Not supplied

Affected versions: *-1.9.1
Patched versions: Not supplied

Affected versions: [*, 1.1)
Patched versions: 1.1

Affected versions: *-3.1
Patched versions: 3.2

Affected versions: *-2.4.7
Patched versions: Not supplied

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-1.0.5
Patched versions: Not supplied

Affected versions: [*, 2.7.3)
Patched versions: 2.7.3

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-201704251008
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-2.0
Patched versions: Not supplied

Affected versions: [*, 1.7.2)
Patched versions: 1.7.2

Affected versions: [*, 3.0.2)
Patched versions: 3.0.2

Affected versions: *-1.0.3
Patched versions: Not supplied

Affected versions: *-1.1.1
Patched versions: Not supplied

Affected versions: [*, 4.1.9.5)
Patched versions: 4.1.9.5

Affected versions: [*, 3.0.6)
Patched versions: 3.0.6

Affected versions: [*, 0.7.2)
Patched versions: 0.7.2

Affected versions: [*, 2.5.2)
Patched versions: 2.5.2

Affected versions: *-1.5.2
Patched versions: Not supplied

Affected versions: [*, 4.0.5)
Patched versions: 4.0.5

Affected versions: [*, 3.3.57)
Patched versions: 3.3.57

Affected versions: [*, 2.6.4)
Patched versions: 2.6.4

Affected versions: [*, 3.0.9)
Patched versions: 3.0.9

Affected versions: *-201703020805
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-1.2.2
Patched versions: Not supplied

Affected versions: *-1.0.2
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: *-0.0.17
Patched versions: Not supplied

Affected versions: *-1.0.1
Patched versions: Not supplied

Affected versions: *-1.0.4
Patched versions: Not supplied

Affected versions: *-1.4.0
Patched versions: Not supplied

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-2.0
Patched versions: Not supplied

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-1.0.0
Patched versions: Not supplied

Affected versions: [*, 3.3.0)
Patched versions: 3.3.0

Affected versions: [*, 2.2.3.1)
Patched versions: 2.2.3.1

Affected versions: *-1.1
Patched versions: Not supplied

Affected versions: *-1.0
Patched versions: Not supplied

Affected versions: *-1.0.9.21
Patched versions: 1.0.9.22

Affected versions: *-1.0.2
Patched versions: Not supplied

Affected versions: [*, 1.0.4)
Patched versions: 1.0.4

Affected versions: [*, 0.1.1)
Patched versions: 0.1.1

Affected versions: [*, 1.1.4)
Patched versions: 1.1.4

Affected versions: [*, 3.1.7)
Patched versions: 3.1.7

Affected versions: *-1.6.1
Patched versions: Not supplied

Affected versions: [*, 1.0.1)
Patched versions: 1.0.1

Affected versions: [*, 3.2)
Patched versions: 3.2

Affected versions: [*, 0.7.1)
Patched versions: 0.7.1

Affected versions: *-1.0.1
Patched versions: Not supplied

Original Wordfence record

HighCVE-2019-17574

Popup-Maker <= 1.8.12 - Unauthenticated information disclosure

Published: October 14, 2019

Affected versions: *-1.8.12
Patched versions: 1.8.13

Original Wordfence record

HighCVE-2026-8848

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation

Published: July 8, 2026

Affected versions: *-1.22.0
Patched versions: 1.23.0

Original Wordfence record

MediumCVE-2024-2336

Popup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 20, 2024

Affected versions: *-1.18.2
Patched versions: 1.18.3

Original Wordfence record

MediumCVE-2025-4205

Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter

Published: June 2, 2025

Affected versions: *-1.20.4
Patched versions: 1.20.5

Original Wordfence record

MediumCVE-2022-4362

Popup Maker <= 1.16.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: September 23, 2022

Affected versions: *-1.16.8
Patched versions: 1.16.9

Original Wordfence record

MediumCVE-2024-7054

Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: August 19, 2024

Affected versions: *-1.19.0
Patched versions: 1.19.1

Original Wordfence record

MediumCVE-2025-9490

Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter

Published: September 25, 2025

Affected versions: *-1.20.6
Patched versions: 1.21.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory