WordPress popup-box has 12 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-24458 | The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or valida | high | 8.8 | <2.3.4 | 2.3.4 |
| CVE-2021-24460 | The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orde | high | 8.8 | <3.5.3 | 3.5.3 |
| CVE-2022-29445 | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPres | medium | 6.8 | <=2.1.2 | – |
| CVE-2023-6591 | The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | <20.9.0 | 20.9.0 |
| CVE-2023-2362 | The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Cal | medium | 6.1 | <2.2.2 | 2.2.2 |
| CVE-2023-5343 | The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | <3.7.9 | 3.7.9 |
| CVE-2023-5809 | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | <3.8.6 | 3.8.6 |
| CVE-2023-5874 | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | <3.8.6 | 3.8.6 |
| CVE-2023-4390 | The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as a | medium | 4.8 | <3.7.2 | 3.7.2 |
| CVE-2024-9599 | The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 5.4 | <4.7.8 | 4.7.8 |
| CVE-2024-3477 | The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in a | medium | 4.3 | <2.2.7 | 2.2.7 |
| CVE-2025-15611 | The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup da | medium | 5.4 | <5.5.0 | 5.5.0 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked