LOW 3.7 NVD

CVE-2026-112230

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unaut

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

References

https://wpscan.com/vulnerability/b5af802e-3667-41da-b543-b5e1bd7ba7ee/

Published: 2026-10-23 · Source: NVD · Feed updated: 2026-10-23

This low severity vulnerability with a CVSS score of 3.7 was published on 2026-10-23 via NVD.

vulnfeed aggregates 15176 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.