Ays Pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups vulnerabilities
4 vulnerabilities
Known vulnerabilities in Ays Pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2026-100159ays-pro · popup box – create countdown, coupon, video, contact form popupsPopup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP HeadersThe Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.EPSS0.26%MediumCVE-2024-10861ays-pro · popup box – create countdown, coupon, video, contact form popups +1 morePopup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options UpdateThe Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.EPSS0.39%MediumCVE-2024-3897ays-pro · popup box – create countdown, coupon, video, contact form popups +1 morePopup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information ExposureThe Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on the website.EPSS0.62%MediumCVE-2026-1165ays-pro · popup box – create countdown, coupon, video, contact form popups +1 morePopup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status ChangeThe Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish status of popups via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.EPSS0.19%