Popup Builder < 4.2.3 - Unauthenticated Stored XSS
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01999 80th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed Popup Builder (Unknown): 4.2.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Popup Builder | before 4.2.3 | 4.2.3 | Patch available | CNA |
- Popup Builder VendorUnknown Affected before 4.2.3 Fixed in 4.2.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:* | before 4.2.3 | Vulnerable | popupbuilder |
- cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:* Versions before 4.2.3 Vulnerable ·popupbuilder
Remediation
- Fix · CNA Popup Builder (Unknown) Fixed in 4.2.3
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6000
- 2026-10-03 Alias added: GHSA-fhw3-qv5f-7vrw
References
More popupbuilder Popup Builder vulnerabilities
- TI-2022-00402 Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting CVSS 3.1CRITICAL 9.8
- TI-2023-05777 popup-builder < 4.2.6 - Admin+ SSRF & File Read CVSS 3.1HIGH 7.5
- TI-2024-08748 Popup Builder < 4.3.5 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2020-07226 The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL… CVSS 3.1CRITICAL 9.8
- TI-2019-10917 A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for… CVSS 3.1CRITICAL 9.8
- TI-2021-07360 Popup Builder < 4.0.7 - LFI to RCE CVSS 3.1HIGH 8.8
Sources
- CVE-2023-6000 · CVE Program
- CVE-2023-6000 · NVD
- FIRST EPSS
- GHSA-fhw3-qv5f-7vrw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences