Extension WordPress
Vulnérabilités Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
Cette page rassemble les failles publiées pour Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
7 fiches
PopupKit <= 2.2.0 – Missing Authorization to Sensitive Information Disclosure and Data Deletion
The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API…
*-2.2.0
2.2.1
09/02/2026
Popup builder with Gamification <= 2.2.0 – Unauthenticated SQL Injection via Multiple REST API Endpoints
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Injection via the multiple REST API endpoints in all versions up to, and including, 2.2.0 due to insufficient…
*-2.2.0
2.2.1
04/02/2026
Popupkit <= 2.2.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion
The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoint in all versions up to, and including, 2.2.0. This is due to the `permission_callback` only…
*-2.2.0
2.2.1
05/01/2026
PopupKit <= 2.1.5 – Authenticated (Subscriber+) Information Exposure
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level…
*-2.1.5
2.2.1
29/12/2025
PopupKit <= 2.1.5 – Authenticated (Subscriber+) SQL Injection
The PopupKit plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…
*-2.1.5
2.2.0
21/11/2025
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 – Unauthenticated Server-Side Request Forgery
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs…
*-2.1.4
2.1.5
23/10/2025
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 – Unauthenticated SQL Injection via 'id'
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter…
*-2.1.3
2.1.4
08/10/2025
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.