WordPress plugin
Popup Builder – Create highly converting, mobile friendly marketing popups. security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 25 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High6
- Medium15
- Low0
All Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.1 | Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters ≤4.4.5Update to 4.4.6 | CVE-2026-89270 | |
| High8.1 | Missing Authorization and Nonce Exposure ≤4.3.1Update to 4.3.2 | CVE-2023-6696 | |
| High7.4 | Missing Authorization in Multiple AJAX Actions ≤4.3.0Update to 4.3.2 | CVE-2024-2544 | |
| High8.8 | Cross-Site Request Forgery to Settings Update ≤4.1.11Update to 4.1.12 | CVE-2022-29495 | |
| Critical9.8 | SQL Injection <4.1.1Update to 4.1.1 | CVE-2022-0479 | |
| High8.8 | Local File Inclusion and PHAR Deserialization <4.0.7Update to 4.0.7 | CVE-2021-25082 | |
| High7.2 | Authenticated SQL Injection via order & orderby Parameters <4.0.7Update to 4.0.7 | CVE-2022-0228 | |
| High8.3 | Unauthenticated Stored Cross-Site Scripting ≤3.63Update to 3.64.1 | CVE-2020-10196 | |
| Critical9.8 | 2.6.7.6 - PHP Object Injection 2.2.8 – 2.6.7.6Update to 3.0 | CVE-2020-9006 | |
| Critical9.8 | SQL Injection ≤3.44Update to 3.45 | CVE-2019-14695 |
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
≤4.4.5Update to 4.4.6
- High8.1Missing Authorization and Nonce Exposure
≤4.3.1Update to 4.3.2
- High7.4Missing Authorization in Multiple AJAX Actions
≤4.3.0Update to 4.3.2
- High8.8Cross-Site Request Forgery to Settings Update
≤4.1.11Update to 4.1.12
- Critical9.8SQL Injection
<4.1.1Update to 4.1.1
- High8.8Local File Inclusion and PHAR Deserialization
<4.0.7Update to 4.0.7
- High7.2Authenticated SQL Injection via order & orderby Parameters
<4.0.7Update to 4.0.7
- High8.3Unauthenticated Stored Cross-Site Scripting
≤3.63Update to 3.64.1
- Critical9.82.6.7.6 - PHP Object Injection
2.2.8 – 2.6.7.6Update to 3.0
- Critical9.8SQL Injection
≤3.44Update to 3.45
Popup Builder – Create highly converting, mobile friendly marketing popups.: common questions
Does Popup Builder – Create highly converting, mobile friendly marketing popups. have known vulnerabilities?
Yes. VulnCrest Radar lists 25 known vulnerabilities in Popup Builder – Create highly converting, mobile friendly marketing popups.: 4 critical, 6 high, 15 medium. None are known to affect version null.
How do I check which version of Popup Builder – Create highly converting, mobile friendly marketing popups. I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerability?
CVE-2026-89270, published Oct 30, 2026: Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters. Severity: Critical (CVSS 9.1).
Is any Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerability listed in CISA KEV?
No. None of the known Popup Builder – Create highly converting, mobile friendly marketing popups. vulnerabilities is currently listed in the CISA KEV catalog.