Popup Builder – Create highly converting, mobile friendly marketing popups.

Vulnerabilities

• CVE-2020-9006

  The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax

  Critical 9.8

• CVE-2019-14695

  A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress.

  Critical 9.8

• CVE-2023-6696

  Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure

  High 8.1

• CVE-2024-2541

  Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File

  High 7.5

• CVE-2024-30184

  WordPress Popup Builder plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2025-9856

  Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 6.4

• CVE-2024-2544

  Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions

  Medium 6.4

• CVE-2024-2506

  Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS

  Medium 6.4

• CVE-2025-13079

  Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predicta

  Medium 5.3

• CVE-2019-25744

  WordPress Popup Builder 3.49 Persistent Cross-Site Scripting

  Medium 5.1

• CVE-2022-29495

  WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update

  Medium 4.3

• CVE-2022-32289

  WordPress Popup Builder plugin <= 4.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change

  Medium 4.3