CVE-2021-25082: Sygnoos Popup Builder

High severity, CVSS 8.8. EPSS: 5.2% chance of exploitation in the next 30 days.

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR

Affected products

• Sygnoos Popup Builder: before 4.0.7 (fixed in 4.0.7)

Published 2022-02-21. Last modified 2026-06-17.