Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · ays-popup-box
Popup box
19 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 15, 2026Popup Box: Arbitrary Shortcode ExecutionCVE-2026-100159 · affects 6.4.1 to 6.4.2 · reported by WordfenceMedium 4.8
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Administrator SQL Injection in Popup box <= 6.0.1 versions.CVE-2026-57631 · reported by PatchstackHigh 7.6
Administrator SQL Injection in Popup box <= 6.0.1 versions.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.CVE-2026-54192 · affects up to 6.2.9 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.
Apr 7, 2026Popup Box: Does not properly validate nonces in the add_or_edit_popupbox() function before saving popup dataCVE-2025-15611 · fixed in 5.5.0 · reported by WPScanMedium 5.4
The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
Jan 31, 2026Popup Box: Cross-Site Request ForgeryCVE-2026-1165 · affects up to 6.1.1 · reported by WordfenceMedium 4.3
The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish status of popups via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025Popup box: Cross-Site Request Forgery (CSRF)CVE-2025-69021 · affects up to 6.0.7 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.
Oct 29, 2025Popup box: Cross-Site Request Forgery (CSRF)CVE-2025-57931 · affects up to 5.5.4 · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 5.5.4.
May 15, 2025Popup Box: Does not sanitise and escape some of its settingsCVE-2024-9599 · fixed in 4.7.8 · reported by WPScanMedium 5.4
The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Nov 15, 2024Popup Box – Create Countdown, Coupon, Video, Contact Form Popups: Unauthorized modification of dataCVE-2024-10861 · affects up to 4.9.7 · reported by WordfenceMedium 5.3
The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024Popup box: Missing AuthorizationCVE-2024-37096 · affects up to 4.5.1 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Popup Box Team Popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup box: from n/a through 4.5.1.
May 6, 2024Popup box: Cross-Site Request Forgery (CSRF)CVE-2024-34367 · affects up to 4.1.2 · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4.1.2.
May 2, 2024Popup Box – Best WordPress Popup: Unauthorized access of dataCVE-2024-3897 · affects up to 4.3.6 · reported by WordfenceMedium 5.3
The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on the website.
May 2, 2024Popup Box: Does not have CSRF checks in some bulk actionsCVE-2024-3477 · fixed in 2.2.7 · reported by WPScanMedium 4.3
The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks
Feb 12, 2024Popup Box: Does not sanitise and escape some of its settingsCVE-2023-6591 · fixed in 20.9.0 · reported by WPScanMedium 4.8
The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5874 · fixed in 3.8.6 · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5809 · fixed in 3.8.6 · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Nov 20, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5343 · fixed in 3.7.9 · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Oct 31, 2023Popup box: Does not sanitize and escape some Popup fieldsCVE-2023-4390 · fixed in 3.7.2 · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Jun 21, 2023Unauth.CVE-2023-27414 · fixed in 3.4.5 · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin <= 3.4.4 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.