CVE-2023-47308: Activedesign Newsletterpop

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL injection in affected versions. The method `NewsletterpopsendVerificationModuleFrontController::checkEmailSubscription()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.

Affected products

• Activedesign Newsletterpop: from 2.3.1, up to and including 2.4.53; from 2.5.2, before 2.6.1 (fixed in 2.6.1)

Published 2023-11-15. Last modified 2026-06-17.