CVE-2023-6294: Sygnoos Popup Builder

High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days.

The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.

Affected products

• Sygnoos Popup Builder: before 4.2.6 (fixed in 4.2.6)

Published 2024-02-12. Last modified 2026-06-17.