CVE-2019-25744 - WordPress Popup Builder 3.49 Persistent Cross-Site Scripting

Back Back to CVE browser

MEDIUM

WordPress Popup Builder 3.49 Persistent Cross-Site Scripting

Published Jun 4, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.17%

Description

WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the post_title parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads in the post_title field that execute when pages or posts display popup selections.

Affected products

Vendor Popup-Builder Product Popup Builder Default
n/a
- Version
  3.49
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Popup-Builder

Popup Builder

n/a

Version	Status	Constraints
3.49	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20180
Advisory
https://popup-builder.com/
product
https://wordpress.org/plugins/popup-builder/
product
https://www.exploit-db.com/exploits/47518
exploit
https://www.vulncheck.com/advisories/wordpress-popup-builder-persistent-cross-site-scripting
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20180		Advisory
https://popup-builder.com/		product
https://wordpress.org/plugins/popup-builder/		product
https://www.exploit-db.com/exploits/47518		exploit
https://www.vulncheck.com/advisories/wordpress-popup-builder-persistent-cross-site-scripting		third-party-advisory