High severity7.2NVD Advisory· Published Feb 21, 2022· Updated Jun 17, 2026

CVE-2022-0228

Description

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Popup Buildercpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <4.0.7
Package: https://wordpress.org/plugins/popup-builder

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/22facac2-52f4-4e5f-be59-1d2934b260d9nvdExploitThird Party Advisory
plugins.trac.wordpress.org/changeset/2659117nvdRelease NotesThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000