https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-9428.htmlhttps://patchthecve.com/cve/CVE-2024-9428.htmlWed, 17 Jun 2026 08:24:33 +0000MEDIUM 4.8: The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-2541.htmlhttps://patchthecve.com/cve/CVE-2024-2541.htmlWed, 17 Jun 2026 07:24:44 +0000MEDIUM 5.3: The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import feature. This makes it possible for unauthenticated attackers to extract sensitive data after an administrator has imported subscribers via a https://patchthecve.com/cve/CVE-2024-3602.htmlhttps://patchthecve.com/cve/CVE-2024-3602.htmlWed, 17 Jun 2026 07:44:36 +0000MEDIUM 4.3: The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnect_promolayer function in all versions up to, and including, 1.1.0. This mahttps://patchthecve.com/cve/CVE-2024-3236.htmlhttps://patchthecve.com/cve/CVE-2024-3236.htmlWed, 17 Jun 2026 07:43:35 +0000MEDIUM 5.4: The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.https://patchthecve.com/cve/CVE-2024-2544.htmlhttps://patchthecve.com/cve/CVE-2024-2544.htmlWed, 17 Jun 2026 07:24:44 +0000HIGH 7.4: The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, suchhttps://patchthecve.com/cve/CVE-2023-6696.htmlhttps://patchthecve.com/cve/CVE-2023-6696.htmlWed, 17 Jun 2026 06:51:15 +0000HIGH 8.1: The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check, thttps://patchthecve.com/cve/CVE-2023-6294.htmlhttps://patchthecve.com/cve/CVE-2023-6294.htmlWed, 17 Jun 2026 06:50:28 +0000HIGH 7.2: The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.