CVE-2020-10196, CVE-2020-10195

The Popup Builder plugin before version 3.64.1 contains a cross-site scripting vulnerability in its AJAX handler located in com/classes/Ajax.php that permits unauthenticated attackers to inject malicious JavaScript into popups. An attacker can exploit the unprotected sgpb_autosave AJAX action by sending a POST request to wp-admin/admin-ajax.php with the popup ID and arbitrary JavaScript code in the allPopupData parameter, which the plugin automatically wraps in script tags and executes when visitors view pages containing the affected popup. Since the popup ID is often visible in the page source, this attack requires minimal reconnaissance, and the automatic script tag insertion typically evades web application firewalls.

Based on public CVE data (MITRE/NVD).