Popup Builder < 4.2.0 - Admin+ Stored Cross-Site Scripting
Priority LOW 22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Why it matters now
EPSS 0.00448 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Popup Builder (Unknown): 4.2.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Popup Builder | before 4.2.0 | 4.2.0 | Patch available | CNA |
- Popup Builder VendorUnknown Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:* | up to 4.1.15 | Vulnerable | popupbuilder |
- cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:* Versions up to 4.1.15 Vulnerable ·popupbuilder
Remediation
- Fix · CNA Popup Builder (Unknown) Fixed in 4.2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3226
- 2026-10-03 Alias added: GHSA-mf59-9v62-m2hw
References
More popupbuilder Popup Builder vulnerabilities
- TI-2022-00402 Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting CVSS 3.1CRITICAL 9.8
- TI-2023-05777 popup-builder < 4.2.6 - Admin+ SSRF & File Read CVSS 3.1HIGH 7.5
- TI-2024-08748 Popup Builder < 4.3.5 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2020-07226 The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL… CVSS 3.1CRITICAL 9.8
- TI-2019-10917 A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for… CVSS 3.1CRITICAL 9.8
- TI-2021-07360 Popup Builder < 4.0.7 - LFI to RCE CVSS 3.1HIGH 8.8
Sources
- CVE-2023-3226 · CVE Program
- CVE-2023-3226 · NVD
- FIRST EPSS
- GHSA-mf59-9v62-m2hw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences