UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-100159

Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers

Severity
Medium 4.8
Published
16 Oct 2026
Last changed
16 Oct 2026
Added to UpHeron
16 Oct 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
Ays Popup Box (WordPress plugin)WordPress plugins · wp-plugin:ays-popup-box
  • From 6.4.1 up to 6.4.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-100159