CVE-2024-9061

The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. NOTE: This vulnerability was partially fixed in version 1.3.5 with a nonce check, which effectively prevented access to the affected function. However, version 1.3.6 incorporates the correct authorization check to prevent unauthorized access.

• CWE-94

• https://plugins.trac.wordpress.org/changeset/3166506/wp-popup-builderPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0cac1dc0-87dc-43eb-9db1-638a91200b43?source=cveThird Party Advisory

Published

Oct 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9055The DPA countermeasures on Silicon Labs' Series 2 devices ar…4.2
• CVE-2024-9056BentoML version v1.3.4post1 is vulnerable to a Denial of Ser…7.5
• CVE-2024-9057The Curator.io: Show all your social media posts in a beauti…5.4
• CVE-2024-9058The Element Pack Elementor Addons (Header Footer, Template L…5.4
• CVE-2024-9059The Royal Elementor Addons and Templates plugin for WordPres…5.4
• CVE-2024-9060The AVIF & SVG Uploader plugin for WordPress is vulnerable t…6.4
• CVE-2024-9062The Archify application contains a local privilege escalatio…7.8
• CVE-2024-9063Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-9064The Elementor Inline SVG plugin for WordPress is vulnerable …5.4
• CVE-2024-9065The WP Helper Premium plugin for WordPress is vulnerable to …5.3
• CVE-2024-9066The Marketing and SEO Booster plugin for WordPress is vulner…5.4
• CVE-2024-9067The Youzify – BuddyPress Community, User Profile, Social Net…4.3