WordPress plugin
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium19
- Low0
All Popup Box – Create Countdown, Coupon, Video, Contact Form Popups vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.8 | 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers 6.4.1 – 6.4.2Update to 6.4.3 | CVE-2026-100159 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection ≤6.0.1Update to 6.0.2 | CVE-2026-57631 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤6.2.9Update to 6.3.0 | CVE-2026-54192 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting <5.5.0Update to 5.5.0 | CVE-2025-15611 | |
| Medium4.3 | Cross-Site Request Forgery to Popup Status Change ≤6.1.1Update to 6.1.2 | CVE-2026-1165 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.0.7Update to 6.0.8 | CVE-2025-69021 | |
| Medium4.3 | Cross-Site Request Forgery ≤5.5.4Update to 5.5.5 | CVE-2025-57931 | |
| Medium5.3 | Missing Authorization to Unauthenticated Limited Options Update ≤4.9.7Update to 4.9.8 | CVE-2024-10861 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤4.7.7Update to 4.7.8 | CVE-2024-9599 | |
| Medium4.3 | Missing Authorization ≤4.5.1Update to 4.5.2 | CVE-2024-37096 | |
| Medium6.1 | Cross-Site Request Forgery ≤4.1.2Update to 4.1.3 | CVE-2024-34367 | |
| Medium5.3 | Missing Authorization to Information Exposure ≤4.3.6Update to 4.3.7 | CVE-2024-3897 | |
| Medium6.6 | 7.9.0) and Developer (20.0.0 - 20.9.0) - Authenticated (Admin+) Stored Cross-Site Scripting 20.0.0 – <20.9.0Update to 20.9.0 | CVE-2023-6591 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting <3.8.7Update to 3.8.7 | CVE-2023-5874 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting <3.8.7Update to 3.8.7 | CVE-2023-5809 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤3.7.8Update to 3.7.9 | CVE-2023-5343 | |
| Medium4.4 | Authenticated(Administrator+) Stored Cross-Site Scripting <3.7.2Update to 3.7.2 | CVE-2023-4390 | |
| Medium4.4 | Authenticated(Administrator+) Stored Cross-Site Scripting <3.7.1Update to 3.7.1 | — | |
| Medium5.4 | Reflected Cross-Site Scripting via 'ays_pb_tab' Parameter ≤3.4.4Update to 3.4.5 | CVE-2023-27414 | |
| High8.8 | Authenticated SQL Injection <2.3.4Update to 2.3.4 | CVE-2021-24458 | |
| Medium6.1 | Cross-Site Scripting ≤2.3.3Update to 2.3.4 | — |
- Medium4.86.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
6.4.1 – 6.4.2Update to 6.4.3
- Medium4.9Authenticated (Administrator+) SQL Injection
≤6.0.1Update to 6.0.2
- Medium6.1Reflected Cross-Site Scripting
≤6.2.9Update to 6.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
<5.5.0Update to 5.5.0
- Medium4.3Cross-Site Request Forgery to Popup Status Change
≤6.1.1Update to 6.1.2
- Medium4.3Cross-Site Request Forgery
≤6.0.7Update to 6.0.8
- Medium4.3Cross-Site Request Forgery
≤5.5.4Update to 5.5.5
- Medium5.3Missing Authorization to Unauthenticated Limited Options Update
≤4.9.7Update to 4.9.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.7.7Update to 4.7.8
- Medium4.3Missing Authorization
≤4.5.1Update to 4.5.2
- Medium6.1Cross-Site Request Forgery
≤4.1.2Update to 4.1.3
- Medium5.3Missing Authorization to Information Exposure
≤4.3.6Update to 4.3.7
- Medium6.67.9.0) and Developer (20.0.0 - 20.9.0) - Authenticated (Admin+) Stored Cross-Site Scripting
20.0.0 – <20.9.0Update to 20.9.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
<3.8.7Update to 3.8.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
<3.8.7Update to 3.8.7
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.7.8Update to 3.7.9
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
<3.7.2Update to 3.7.2
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
<3.7.1Update to 3.7.1
- Medium5.4Reflected Cross-Site Scripting via 'ays_pb_tab' Parameter
≤3.4.4Update to 3.4.5
- High8.8Authenticated SQL Injection
<2.3.4Update to 2.3.4
- Medium6.1Cross-Site Scripting
≤2.3.3Update to 2.3.4
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups: common questions
Does Popup Box – Create Countdown, Coupon, Video, Contact Form Popups have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Popup Box – Create Countdown, Coupon, Video, Contact Form Popups: 2 high, 19 medium. None are known to affect version null.
How do I check which version of Popup Box – Create Countdown, Coupon, Video, Contact Form Popups I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Popup Box – Create Countdown, Coupon, Video, Contact Form Popups vulnerability?
CVE-2026-100159, published Oct 15, 2026: Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers. Severity: Medium (CVSS 4.8).
Is any Popup Box – Create Countdown, Coupon, Video, Contact Form Popups vulnerability listed in CISA KEV?
No. None of the known Popup Box – Create Countdown, Coupon, Video, Contact Form Popups vulnerabilities is currently listed in the CISA KEV catalog.