Critical severity9.8NVD Advisory· Published Mar 28, 2022· Updated Jun 17, 2026

CVE-2022-0479

Description

The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Popup Buildercpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <4.1.1
Package: https://wordpress.org/plugins/popup-builder

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2686454nvdPatchThird Party Advisory
wpscan.com/vulnerability/0d2bbbaf-fbfd-4921-ba4e-684e2e77e816nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.035
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000