CVE-2022-0479 Popup Builder Plugin - SQL Injection and Cross-Site Scripting · CloudMap

严重CVE-2022-0479

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

披露于 2022/02/07 · 更新于 2025/10/30

CVSS 评分9.8/ 10.0

EPSS 概率62.3%百分位 98.3%

漏洞描述

The Popup Builder WordPress plugin before 4.1.1 is vulnerable to SQL Injection and Reflected XSS via the sgpb-subscription-popup-id parameter.

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

RELATED INTELLIGENCE

与 popup_builder 相关的其他公开漏洞。

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2022-29495 WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery popup_builder	中危	—	—	PoCEXP	2026/02/26
CVE-2023-6000 WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS popup_builder	中危	6.1	—	PoCEXP	2025/10/04
CVE-2022-0228 Popup Builder < 4.0.7 - SQL Injection popup_builder	高危	7.2	7.0%	PoCEXP	2022/02/23
CVE-2021-25082 WordPress Popup Builder < 4.0.7 - Remote Code Execution popup_builder	高危	8.8	—	PoCEXP	2022/02/21