Approved changes feed: RSS · Atom

cpe:2.3:a:essentialplugin:popup_anything:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

VendorEssentialplugin (7cc9011c-ee3a-5cc4-b415-3927e0ae0329)
ProductPopup Anything (b100f731-3275-5575-b389-771ccfa9932b)
Edition*
Language*
Software edition*
Target softwarewordpress
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-38077 vulnerable 2026-06-03 14:47:48.432763 WordPress Popup Anything Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
MEDIUM (4.3)
Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
Published: 2023-03-29T12:19:03.503Z
Updated: 2026-04-28T16:07:46.937Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-2115 vulnerable 2026-06-03 14:47:00.290514 Popup Anything < 2.1.7 - Reflected Cross-Site Scripting
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting
Published: 2022-07-25T12:46:58.000Z
Updated: 2024-08-03T00:24:44.274Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-24883 vulnerable 2026-06-03 14:44:03.904369 Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site Scripting
The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Published: 2021-11-29T08:25:44.000Z
Updated: 2024-08-03T19:49:12.675Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.