GCVE - cpe:2.3:a:unknown:popup_builder:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:popup_builder:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Popup Builder (`e4d1e792-aa6b-5972-8950-7fa4765f24cc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-9428`	vulnerable	2026-06-08 07:00:27.517404	Popup Builder < 4.3.5 - Admin+ Stored XSS The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2024-12-12T06:00:18.844Z Updated: 2024-12-12T17:22:46.068Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/6e246547-e509-48db-88ae-b2f943398377/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3236`	vulnerable	2026-06-08 06:41:52.752447	Easy Notify Lite < 1.1.33 - Contributor+ Stored XSS The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks. Published: 2024-06-17T06:00:01.133Z Updated: 2024-08-01T20:05:08.361Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/a6c2da28-dc03-4bcc-a6c3-ee55a73861db/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6294`	vulnerable	2026-06-08 06:19:46.878410	popup-builder < 4.2.6 - Admin+ SSRF & File Read The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations. Published: 2024-02-12T16:06:01.185Z Updated: 2025-04-24T15:43:33.724Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/eaeb5706-b19c-4266-b7df-889558ee2614/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6000`	vulnerable	2026-06-08 06:19:45.376307	Popup Builder < 4.2.3 - Unauthenticated Stored XSS The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks. Published: 2024-01-01T14:18:56.633Z Updated: 2025-06-18T14:55:45.937Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9029-0490273bcfc8 https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3226`	vulnerable	2026-06-08 06:09:38.892290	Popup Builder < 4.2.0 - Admin+ Stored Cross-Site Scripting The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2023-09-25T15:56:52.128Z Updated: 2024-08-02T06:48:08.186Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/941a9aa7-f4b2-474a-84d9-9a74c99079e2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.