CVE Database /
CVE-2022-0479
CVE · Critical
CVE-2022-0479 — Popup Builder – Create highly converting, mobile friendly marketing popups. [popup-builder] < 4.1.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-0479
|
Popup Builder – Create highly converting, mobile friendly marketing popups. [popup-builder] < 4.1.1 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Critical
9.8
|
< 4.1.1
|
4.1.1 |
2022-03-07 |
—
|
CVE-2022-0479
The Popup Builder plugin versions prior to 4.1.1 fail to properly sanitize the sgpb-subscription-popup-id parameter before incorporating it into SQL queries on the All Subscribers administrative page, creating a SQL injection vulnerability that could additionally enable reflected cross-site scripting attacks against administrators who click on malicious links.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings