CVE-2024-2506

The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS functionality in all versions up to, and including, 4.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3085485%40popup-builder&new=3085485%40popup-builder&sfp_email=&sfph_mail=#file51
• https://www.wordfence.com/threat-intel/vulnerabilities/id/804a973e-4650-428c-910f-09e4fc3aa4bb?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3085485%40popup-builder&new=3085485%40popup-builder&sfp_email=&sfph_mail=#file51
• https://www.wordfence.com/threat-intel/vulnerabilities/id/804a973e-4650-428c-910f-09e4fc3aa4bb?source=cve

Published

Jun 1, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25048IBM MQ Appliance 9.3 CD and LTS are vulnerable to a heap-bas…7.5
• CVE-2024-2505The GamiPress WordPress plugin before 6.8.9's access contro…8.1
• CVE-2024-25050IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio…7.8
• CVE-2024-25051IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalida…7.2
• CVE-2024-25052IBM Jazz Reporting Service 7.0.3 stores user credentials in …4.4
• CVE-2024-25053IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4,…5.9
• CVE-2024-25062An issue was discovered in libxml2 before 2.11.7 and 2.12.x …7.5
• CVE-2024-25063Due to insufficient server-side validation, a successful exp…7.5
• CVE-2024-25064Due to insufficient server-side validation, an attacker with…4.3
• CVE-2024-25065Possible path traversal in Apache OFBiz allowing authenticat…9.1
• CVE-2024-25066RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML…4.3
• CVE-2024-2507The JetWidgets For Elementor plugin for WordPress is vulnera…5.4