PT-2020-11969 · WordPress · Popup Builder

Published 2020-03-13 · Updated 2025-05-07 · CVE-2020-10196

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions popup-builder plugin versions prior to 3.64.1

Description The issue allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. An unauthenticated attacker can insert malicious JavaScript in several of the popup's fields by sending a request to "wp-admin/admin-ajax.php" with the POST action parameter of sgpb autosave and including additional data in an allPopupData parameter, which includes the popup's ID and arbitrary JavaScript. This injection typically bypasses most WAF applications because the plugin functionality automatically adds script tags to data entered into these fields.

Recommendations For versions prior to 3.64.1, update to version 3.64.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-ajax.php" endpoint with the sgpb autosave action parameter to minimize the risk of exploitation. Avoid using the allPopupData parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-10196

Affected Products

Popup Builder

References · 6

• 🔥 https://wordfence.com/blog/2020/03/vulnerabilities-patched-in-popup-builder-plugin-affecting-over-100000-sites · Exploit
• https://osv.dev/vulnerability/CVE-2020-10196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10196 · Security Note
• https://wpvulndb.com/vulnerabilities/10127 · Note
• https://t.me/cvenotify/1638 · Telegram Post
• https://t.me/cvenotify/121214 · Telegram Post