Plugin vulnerabilities
Is Popup Maker safe? Known vulnerabilities and the version to run.
Popup Maker: builds popups, slide-ins and announcement bars.
The short answer
Run Popup Maker 1.25.0 or later. That version has a fix for every known vulnerability that's been patched.
- Known vulnerabilities
- 22
- In the last 12 months
- 4
- Rated high or critical
- 5
- No fix yet
- 0
Every known Popup Maker vulnerability
Newest first. The most recent was disclosed on 17 September 2026. Each one links to its full record on Wordfence.
| Vulnerability | Severity | Affected versions | Fixed in |
|---|---|---|---|
| Authenticated (Contributor+) Stored Cross-Site Scripting via post_titleCVE-2026-15797 · 17 September 2026 | Medium 6.4 | 1.24.0 and earlier | 1.25.0 |
| Unauthenticated Stored Cross-Site Scripting via values[Name] ParameterCVE-2026-87915 · 17 September 2026 | High 7.2 | 1.24.0 and earlier | 1.25.0 |
| Unauthenticated Stored Cross-Site ScriptingCVE-2026-28177 · 5 August 2026 | High 7.2 | 1.23.0 and earlier | 1.24.0 |
| Missing Authorization to Authenticated (Editor+) Arbitrary Plugin InstallationCVE-2026-8848 · 8 July 2026 | High 7.2 | 1.22.0 and earlier | 1.23.0 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via title ParameterCVE-2025-9490 · 25 September 2025 | Medium 6.4 | 1.20.6 and earlier | 1.21.0 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via popupID ParameterCVE-2025-4205 · 2 June 2025 | Medium 6.4 | 1.20.4 and earlier | 1.20.5 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2025-24746 · 24 January 2025 | Medium 6.4 | 1.20.2 and earlier | 1.20.3 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-10583 · 11 December 2024 | Medium 5.4 | 1.20.2 and earlier | 1.20.3 |
| Missing AuthorizationCVE-2024-47358 · 30 September 2024 | Medium 5.3 | 1.19.2 and earlier | 1.20.0 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-7054 · 19 August 2024 | Medium 6.4 | 1.19.0 and earlier | 1.19.1 |
| Authenticated (Admin+) Stored Cross-Site ScriptingCVE-2024-5561 · 19 August 2024 | Medium 4.4 | 1.19.0 and earlier | 1.19.1 |
| Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-2336 · 20 March 2024 | Medium 6.4 | 1.18.2 and earlier | 1.18.3 |
| Sensitive Data Exposure via debug log fileCVE-2022-47597 · 14 March 2023 | Medium 5.3 | 1.17.1 and earlier | 1.18.0 |
| Missing Authorization via save_popup_enabled_stateCVE-2022-45819 · 9 March 2023 | Medium 5.4 | 1.17.1 and earlier | 1.18.0 |
| Cross-Site Request Forgery via init8 March 2023 | Medium 4.3 | 1.18.0 and earlier | 1.18.1 |
| Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2022-3690 · 31 October 2022 | Medium 5.5 | 1.16.10 and earlier | 1.16.11 |
| Authenticated (Contributor+) Cross-Site ScriptingCVE-2022-4381 · 26 September 2022 | Medium 6.4 | 1.16.8 and earlier | 1.16.9 |
| Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2022-4362 · 23 September 2022 | Medium 6.4 | 1.16.8 and earlier | 1.16.9 |
| Authenticated (Admin+) Cross-Site ScriptingCVE-2022-1104 · 19 April 2022 | Medium 5.5 | 1.16.4 and earlier | 1.16.5 |
| Unauthenticated information disclosureCVE-2019-17574 · 14 October 2019 | High 7.5 | 1.8.12 and earlier | 1.8.13 |
| Missing Authorization to Arbitrary Options Update25 February 2019 | High 8.8 | before 1.8.3 | 1.8.3 |
| Reflected Cross-Site ScriptingCVE-2017-2284 · 24 July 2017 | Medium 6.1 | before 1.6.5 | 1.6.5 |
If you run Popup Maker
What to do now
- Check your version. In WordPress, go to Plugins and look under Popup Maker. Compare it with the affected versions above.
- Update to 1.25.0 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
- Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.
Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.
Marketing, analytics and email
Related plugins
MonsterInsights
Connects a site to Google Analytics and shows the reports inside WordPress.
12 known2 in the last year
Smash Balloon Instagram Feed
Shows an Instagram feed on a WordPress site.
7 known2 in the last year
Mailchimp for WordPress
A plugin that connects your site's sign-up forms to Mailchimp.
16 known6 in the last year
OptinMonster
Connects a site to OptinMonster's popups and sign-up forms.
5 known
FluentSMTP
Sends WordPress email through a proper mail service such as Amazon SES, Gmail or Mailgun.
6 known1 in the last year
Easy WP SMTP
Sends WordPress email through an SMTP server or mail service so it reaches inboxes.
8 known
Data sources and licences
Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Not sure yet?
Find out how exposed your site is.
Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.
- Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
- WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
- 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix