CVE-2021-24631: Unlimited Popups Project Unlimited Popups

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection

Affected products

• Unlimited Popups Project Unlimited Popups: up to and including 4.5.3

Published 2021-11-08. Last modified 2026-06-17.