WordPress plugin
Popup Builder – Create highly converting, mobile friendly marketing popups. security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 25 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High6
- Medium15
- Low0
All Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerabilities
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
≤4.4.5Update to 4.4.6
- Medium5.3Missing Authorization
<4.4.6Update to 4.4.6
- Medium5.3Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens
≤4.4.2Update to 4.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.4.1Update to 4.4.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.3.4Update to 4.3.5
- Medium5.3Sensitive Information Exposure via Imported Subscribers CSV File
≤4.3.6Update to 4.3.7
- High8.1Missing Authorization and Nonce Exposure
≤4.3.1Update to 4.3.2
- High7.4Missing Authorization in Multiple AJAX Actions
≤4.3.0Update to 4.3.2
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS
≤4.2.7Update to 4.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.2.6Update to 4.2.7
- Medium5.5Authenticated (Admin+) Server-Side Request Forgery
≤4.2.5Update to 4.2.6
- Medium6.1Unauthenticated Stored Cross-Site Scripting
<4.2.3Update to 4.2.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.2.1Update to 4.2.2
- High8.8Cross-Site Request Forgery to Settings Update
≤4.1.11Update to 4.1.12
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
≤4.1.10Update to 4.1.11
- Medium4.3Cross-Site Request Forgery
≤4.1.0Update to 4.1.11
- Critical9.8SQL Injection
<4.1.1Update to 4.1.1
- High8.8Local File Inclusion and PHAR Deserialization
<4.0.7Update to 4.0.7
- High7.2Authenticated SQL Injection via order & orderby Parameters
<4.0.7Update to 4.0.7
- Medium6.1Reflected Cross-Site Scripting
≤3.73Update to 3.74
- Medium6.3Popup Builder <= 3.72 Missing Authorization on AJAX actions
≤3.71Update to 3.72
- Medium6.3Authenticated Settings Modification, Configuration Disclosure, and User Data Export
≤3.63Update to 3.64.1
- High8.3Unauthenticated Stored Cross-Site Scripting
≤3.63Update to 3.64.1
- Critical9.82.6.7.6 - PHP Object Injection
2.2.8 – 2.6.7.6Update to 3.0
- Critical9.8SQL Injection
≤3.44Update to 3.45
Popup Builder – Create highly converting, mobile friendly marketing popups.: common questions
Does Popup Builder – Create highly converting, mobile friendly marketing popups. have known vulnerabilities?
Yes. VulnCrest Radar lists 25 known vulnerabilities in Popup Builder – Create highly converting, mobile friendly marketing popups.: 4 critical, 6 high, 15 medium. None are known to affect version null.
How do I check which version of Popup Builder – Create highly converting, mobile friendly marketing popups. I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerability?
CVE-2026-89270, published Oct 30, 2026: Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters. Severity: Critical (CVSS 9.1).
Is any Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerability listed in CISA KEV?
No. None of the known Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerabilities is currently listed in the CISA KEV catalog.