PT-2026-5874 · WordPress · Popup Builder With Gamification
Published
2026-02-04
·
Updated
2026-02-05
·
CVE-2025-13192
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress versions through 2.2.0
Description
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and query preparation. This flaw exists in multiple REST API endpoints and allows unauthenticated attackers to inject SQL queries, potentially extracting sensitive data from the database. The issue was addressed in version 2.2.1 for unauthenticated users and fully resolved in version 2.2.3 for Administrator+ level users. The vulnerability affects the
user supplied parameter within the REST API endpoints.Recommendations
Upgrade to version 2.2.1 or later for unauthenticated users.
Upgrade to version 2.2.3 or later for Administrator+ level users.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Popup Builder With Gamification