CVE Intelligence

Ays-pro Popup Box vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Ays-pro Popup Box: 5 record(s), with affected versions and fixes.
cpe:2.3:a:ays-pro:popup_box

CVE-2026-57631 High · 7.6 CWE-89 Jun 26, 2026
WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability
Administrator SQL Injection in Popup box <= 6.0.1 versions.
CVE-2026-54192 High · 7.1 CWE-79 Jun 17, 2026
WordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.
CVE-2025-15611 Medium · 5.4 CWE-918 Apr 7, 2026
Popup Box AYS Pro < 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRF
The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
CVE-2025-69021 Medium · 5.4 CWE-352 Dec 30, 2025
WordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.
CVE-2025-57931 Medium · 5.3 CWE-352 Oct 29, 2025
WordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 5.5.4.