PT-2026-46214 · Popup Builder · Popup Builder

Unk9Vvn · Published 2026-06-04 · Updated 2026-06-04 · CVE-2019-25744

Mitre

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

WordPress Popup Builder 3.49 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the post title parameter. Attackers can submit crafted POST requests to the post.php endpoint with script payloads in the post title field that execute when pages or posts display popup selections.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25744

Affected Products

Popup Builder

References · 5

• 🔥 https://exploit-db.com/exploits/47518 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25744 · Security Note
• https://wordpress.org/plugins/popup-builder · Note
• https://vulncheck.com/advisories/wordpress-popup-builder-persistent-cross-site-scripting · Note
• https://popup-builder.com · Note