WordPress plugin · popup-builder
Is Popup Builder safe?
Safe on 4.4.6 or newer.
The current version, 4.4.6, is past every affected range on record (22 of 23 records list one; 1 doesn’t, so check it below). Keep it updated and you’re clear of them.
- Flaws on record
- 23
- High or critical
- 8
- Exploited
- none
- Current version
- 4.4.6
- Last updated
- Oct 19, 2026
- Active installs
- 200,000+
Every recorded flaw
- Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · fixed in 4.4.6 · reported by WPScanLow 3.7
- Jun 4, 2026WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breakinCVE-2019-25744 · reported by VulnCheckMedium 5.1
- Feb 19, 2026Popup Builder – Create highly converting, mobile friendly marketing popups.: Authorization bypassCVE-2025-13079 · affects up to 4.4.2 · reported by WordfenceMedium 5.3
- Dec 13, 2025Popup Builder – Create highly converting, mobile friendly marketing popups.: Stored Cross-Site ScriptingCVE-2025-9856 · affects up to 4.4.1 · reported by WordfenceMedium 6.4
- Dec 12, 2024Popup Builder: Does not sanitise and escape some of its settingsCVE-2024-9428 · fixed in 4.3.5 · reported by WPScanMedium 4.8
- Aug 29, 2024Popup Builder: Sensitive Information ExposureCVE-2024-2541 · affects up to 4.3.6 · reported by WordfenceMedium 5.3
- Jun 17, 2024Popup Builder: Does not sanitise and escape some of its Notification fieldsCVE-2024-3236 · fixed in 1.1.33 · reported by WPScanMedium 5.4
- Jun 14, 2024Popup Builder: Unauthorized modification of data and loss of dataCVE-2024-2544 · fixed in 4.3.2 · reported by WordfenceHigh 7.4
- Jun 14, 2024Popup Builder – Create highly converting, mobile friendly marketing popups.: Unauthorized access of functionalityCVE-2023-6696 · affects up to 4.3.1 · reported by WordfenceHigh 8.1
- Jun 1, 2024Popup Builder – Create highly converting, mobile friendly marketing popups.: Stored Cross-Site ScriptingCVE-2024-2506 · affects up to 4.2.7 · reported by WordfenceMedium 6.4
- Mar 27, 2024Popup Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30184 · affects up to 4.2.6 · reported by PatchstackMedium 6.5
- Feb 12, 2024Popup Builder: Does not validate a parameter before making a request to itCVE-2023-6294 · fixed in 4.2.6 · reported by WPScanHigh 7.2
- Jan 1, 2024Popup Builder: Does not prevent simple visitors from updating existing popupsCVE-2023-6000 · fixed in 4.2.3 · reported by WPScan2.0% oddsMedium 6.1
- Sep 25, 2023Popup Builder: Does not sanitise and escape some of its settingsCVE-2023-3226 · fixed in 4.2.0 · reported by WPScanMedium 4.8
- Jul 22, 2022Sygnoos Popup Builder plugin <= 4.1.11 at: Cross-Site Request Forgery (CSRF)CVE-2022-29495 · affects up to 4.1.11 · reported by PatchstackMedium 5.4
- Jul 21, 2022Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.CVE-2022-32289 · affects up to 4.1.0 · reported by PatchstackMedium 5.4
- Jul 11, 2022Popup Builder: Does not escape and sanitize some settingsCVE-2022-1894 · fixed in 4.1.11 · reported by WPScanMedium 4.8
- Mar 28, 2022Popup Builder: Does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboardCVE-2022-0479 · fixed in 4.1.1 · reported by WPScan44% oddsCritical 9.8
- Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · fixed in 4.0.7 · reported by WPScan5.3% oddsHigh 7.2
- Feb 21, 2022Popup Builder: Does not validate and sanitise the sgpb_type parameter before using it in a require statementCVE-2021-25082 · fixed in 4.0.7 · reported by WPScan5.2% oddsHigh 8.8
- Mar 13, 2020The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via adminCVE-2020-10195 · fixed in 3.64.1 · reported by MITRE1.1% oddsMedium 6.3
- Feb 17, 2020Popup Builder plugin 2.2.8 through 2.6.7.6: SQL injection (in the sgImportPopups function in sg_popup_ajaxCVE-2020-9006 · affects up to 2.6.7.6 · reported by MITRE8.6% oddsCritical 9.8
- Aug 6, 2019A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress.CVE-2019-14695 · fixed in 3.45 · reported by MITRE2.7% oddsCritical 9.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.