Popup Builder – Create highly converting, mobile friendly marketing popups. Security & Risk Analysis

wordpress.org/plugins/popup-builder

Increase Sales, Lead Generation, Conversion rates and receive good Call to Action rates with smart WordPress popup plugin.

200K active installs v4.4.3 PHP 5.3.3+ WP 4.2+ Updated Jan 22, 2026
pop-uppopuppopup-builderpopup-makerwordpress-popup
76
B · Generally Safe
CVEs total23
Unpatched0
Last CVEFeb 18, 2026
Safety Verdict

Is Popup Builder – Create highly converting, mobile friendly marketing popups. Safe to Use in 2026?

Mostly Safe

Score 76/100

Popup Builder – Create highly converting, mobile friendly marketing popups. is generally safe to use. 23 past CVEs were resolved. Keep it updated.

23 known CVEsLast CVE: Feb 18, 2026Updated 2mo ago
Risk Assessment

The "popup-builder" plugin exhibits a mixed security posture. While static analysis indicates a strong adherence to basic security practices, such as 100% output escaping and a high percentage of prepared SQL statements, several areas raise concerns. The presence of 6 flows with unsanitized paths, including 3 of critical severity from the taint analysis, directly points to potential vulnerabilities that could be exploited. The large number of AJAX handlers (33) without authentication checks, although reported as '0 Unprotected' in the summary, warrants closer inspection for proper authorization mechanisms within these handlers.

The plugin's vulnerability history is a significant red flag. With a total of 23 known CVEs, including 3 critical and 6 high-severity issues, this indicates a recurring pattern of security weaknesses. The diverse range of past vulnerability types, from SQL Injection and SSRF to XSS and deserialization issues, suggests a deep-seated need for more robust secure coding practices and thorough code reviews. While there are currently no unpatched CVEs, the sheer volume and historical severity of past vulnerabilities suggest a high likelihood of future discoveries if fundamental coding practices are not improved.

In conclusion, while the plugin has implemented some good security measures, the critical taint analysis findings and the extensive history of severe vulnerabilities cannot be ignored. The plugin is a high risk due to the potential for exploitable code paths and its past security track record. Efforts should focus on addressing the identified unsanitized paths and a comprehensive review of authorization and input validation across all entry points.

Key Concerns

  • Critical severity taint flow found
  • High severity taint flow found
  • Total known CVEs: 23 (indicates recurring vulnerabilities)
  • 3 critical CVEs in history
  • 6 high CVEs in history
  • Flows with unsanitized paths: 6
  • Bundled library: Select2 (potential for outdated/vulnerable)
Vulnerabilities
23

Popup Builder – Create highly converting, mobile friendly marketing popups. Security Vulnerabilities

CVEs by Year

1 CVE in 2019
2019
3 CVEs in 2020
2020
2 CVEs in 2021
2021
6 CVEs in 2022
2022
2 CVEs in 2023
2023
7 CVEs in 2024
2024
1 CVE in 2025
2025
1 CVE in 2026
2026
Patched Has unpatched

Severity Breakdown

Critical
3
High
6
Medium
14

23 total CVEs

CVE-2025-13079medium · 5.3Use of Predictable Algorithm in Random Number Generator

Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens

Feb 18, 2026 Patched in 4.4.3 (1d)
CVE-2025-9856medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Dec 12, 2025 Patched in 4.4.2 (1d)
CVE-2024-9428medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder <= 4.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Nov 21, 2024 Patched in 4.3.5 (22d)
CVE-2024-2541medium · 5.3Exposure of Sensitive Information to an Unauthorized Actor

Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File

Aug 28, 2024 Patched in 4.3.7 (205d)
CVE-2024-2544high · 7.4Missing Authorization

Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions

Jun 14, 2024 Patched in 4.3.2 (1d)
CVE-2023-6696high · 8.1Missing Authorization

Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure

Jun 14, 2024 Patched in 4.3.2 (46d)
CVE-2024-2506medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS

May 31, 2024 Patched in 4.3.0 (56d)
CVE-2024-30184medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Mar 25, 2024 Patched in 4.2.7 (8d)
CVE-2023-6294medium · 5.5Server-Side Request Forgery (SSRF)

Popup Builder <= 4.2.5 - Authenticated (Admin+) Server-Side Request Forgery

Jan 17, 2024 Patched in 4.2.6 (66d)
CVE-2023-6000medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting

Dec 11, 2023 Patched in 4.2.3 (43d)
CVE-2023-3226medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder <= 4.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting

Aug 28, 2023 Patched in 4.2.2 (148d)
CVE-2022-29495high · 8.8Cross-Site Request Forgery (CSRF)

Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.1.11 - Cross-Site Request Forgery to Settings Update

Jun 30, 2022 Patched in 4.1.12 (572d)
CVE-2022-1894medium · 5.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder <= 4.1.10 - Authenticated (Admin+) Cross-Site Scripting

Jun 20, 2022 Patched in 4.1.11 (582d)
CVE-2022-32289medium · 4.3Cross-Site Request Forgery (CSRF)

Popup Builder <= 4.1.0 - Cross-Site Request Forgery

Jun 17, 2022 Patched in 4.1.11 (585d)
CVE-2022-0479critical · 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Popup Builder <= 4.1.0 - SQL Injection

Mar 7, 2022 Patched in 4.1.1 (687d)
CVE-2022-0228high · 7.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Popup Builder <= 4.0.6 - Authenticated SQL Injection via order & orderby Parameters

Jan 24, 2022 Patched in 4.0.7 (729d)
CVE-2021-25082high · 8.8Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Popup Builder <= 4.0.6 - Local File Inclusion and PHAR Deserialization

Jan 24, 2022 Patched in 4.0.7 (729d)
CVE-2021-24152medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder <= 3.73 - Reflected Cross-Site Scripting

Feb 2, 2021 Patched in 3.74 (1085d)

Popup Builder <= 3.72 Missing Authorization on AJAX actions

Jan 28, 2021 Patched in 3.72 (1090d)
CVE-2020-10196high · 8.3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Popup Builder <= 3.63 - Unauthenticated Stored Cross-Site Scripting

Mar 12, 2020 Patched in 3.64.1 (1412d)
CVE-2020-10195medium · 6.3Exposure of Sensitive Information to an Unauthorized Actor

Popup Builder <= 3.63 - Authenticated Settings Modification, Configuration Disclosure, and User Data Export

Mar 12, 2020 Patched in 3.64.1 (1412d)
CVE-2020-9006critical · 9.8Deserialization of Untrusted Data

Popup Builder 2.2.8 - 2.6.7.6 - PHP Object Injection

Feb 16, 2020 Patched in 3.0 (1437d)
CVE-2019-14695critical · 9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Popup Builder <= 3.44 - SQL Injection

Aug 6, 2019 Patched in 3.45 (1631d)
Code Analysis
Analyzed Mar 16, 2026

Popup Builder – Create highly converting, mobile friendly marketing popups. Code Analysis

Dangerous Functions
0
Raw SQL Queries
11
126 prepared
Unescaped Output
3
1039 escaped
Nonce Checks
38
Capability Checks
32
File Operations
1
External Requests
6
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

92% prepared137 total queries

Output Escaping

100% escaped1042 total outputs
Data Flows
6 unsanitized

Data Flow Analysis

22 flows6 with unsanitized paths
popupSaveAsNew (com\classes\Actions.php:1309)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Popup Builder – Create highly converting, mobile friendly marketing popups. Attack Surface

Entry Points34
Unprotected0

AJAX Handlers 33

authwp_ajax_sgpb_send_to_open_countercom\classes\Ajax.php:50
noprivwp_ajax_sgpb_send_to_open_countercom\classes\Ajax.php:51
authwp_ajax_sgpb_process_after_submissioncom\classes\Ajax.php:53
noprivwp_ajax_sgpb_process_after_submissioncom\classes\Ajax.php:54
authwp_ajax_sgpb_subscription_submissioncom\classes\Ajax.php:56
noprivwp_ajax_sgpb_subscription_submissioncom\classes\Ajax.php:57
authwp_ajax_add_condition_group_rowcom\classes\Ajax.php:62
authwp_ajax_add_condition_rule_rowcom\classes\Ajax.php:63
authwp_ajax_change_condition_rule_rowcom\classes\Ajax.php:64
authwp_ajax_select2_search_datacom\classes\Ajax.php:65
authwp_ajax_change_popup_statuscom\classes\Ajax.php:66
authwp_ajax_check_same_origincom\classes\Ajax.php:68
authwp_ajax_sgpb_subscribers_deletecom\classes\Ajax.php:70
authwp_ajax_sgpb_add_subscriberscom\classes\Ajax.php:71
authwp_ajax_sgpb_import_subscriberscom\classes\Ajax.php:72
authwp_ajax_sgpb_import_settingscom\classes\Ajax.php:73
authwp_ajax_sgpb_save_imported_subscriberscom\classes\Ajax.php:74
authwp_ajax_sgpb_send_newslettercom\classes\Ajax.php:75
authwp_ajax_sgpb_change_review_popup_show_periodcom\classes\Ajax.php:76
authwp_ajax_sgpb_dont_show_review_popupcom\classes\Ajax.php:77
authwp_ajax_sgpb_close_bannercom\classes\Ajax.php:78
authwp_ajax_sgpb_close_license_noticecom\classes\Ajax.php:79
authwp_ajax_sgpb_hide_ask_review_popupcom\classes\Ajax.php:80
authwp_ajax_sgpb_reset_popup_opening_countcom\classes\Ajax.php:81
authwp_ajax_sgpb_dont_show_extension_panelcom\classes\Ajax.php:83
authwp_ajax_sgpb_dont_show_problem_alertcom\classes\Ajax.php:84
authwp_ajax_sgpb_autosavecom\classes\Ajax.php:86
authwp_ajax_sgpb_set_upload_dircom\classes\Ajax.php:88
authwp_ajax_sgpb_reset_upload_dircom\classes\Ajax.php:90
authwp_ajax_sgpb_deactivate_feedbackcom\classes\Feedback.php:11
authwp_ajax_sgpb_dismiss_notificationcom\classes\NotificationCenter.php:23
authwp_ajax_sgpb_remove_notificationcom\classes\NotificationCenter.php:24
authwp_ajax_sgpb_reactivate_notificationcom\classes\NotificationCenter.php:25

Shortcodes 1

[sg_popup] com\classes\Actions.php:63
WordPress Hooks 125
actioninitcom\classes\Actions.php:25
actioninitcom\classes\Actions.php:26
actionadmin_initcom\classes\Actions.php:27
actionadmin_initcom\classes\Actions.php:29
actionadmin_menucom\classes\Actions.php:31
actionadmin_menucom\classes\Actions.php:32
actionadmin_headcom\classes\Actions.php:33
actionadmin_headcom\classes\Actions.php:34
actionadmin_enqueue_scriptscom\classes\Actions.php:35
actionadmin_action_popupSaveAsNewcom\classes\Actions.php:36
actionadmin_post_csv_filecom\classes\Actions.php:37
actionadmin_post_sgpb_system_infocom\classes\Actions.php:38
actionadmin_post_sgpbSaveSettingscom\classes\Actions.php:39
actionadmin_post_sgpb_request_new_unsubscribe_linkcom\classes\Actions.php:40
actionadmin_initcom\classes\Actions.php:41
actionadmin_noticescom\classes\Actions.php:42
actionadmin_initcom\classes\Actions.php:43
actiontransition_post_statuscom\classes\Actions.php:44
actionwp_before_admin_bar_rendercom\classes\Actions.php:46
actionadmin_headcom\classes\Actions.php:47
actionadmin_headcom\classes\Actions.php:48
actionadd_meta_boxescom\classes\Actions.php:49
filterpost_updated_messagescom\classes\Actions.php:50
actionbefore_delete_postcom\classes\Actions.php:51
actionsgpb_duplicate_postcom\classes\Actions.php:52
filterget_sample_permalink_htmlcom\classes\Actions.php:53
actionmedia_buttonscom\classes\Actions.php:55
filtermce_external_pluginscom\classes\Actions.php:56
actionadmin_enqueue_scriptscom\classes\Actions.php:57
actionadmin_enqueue_scriptscom\classes\Actions.php:58
actionsave_postcom\classes\Actions.php:60
actionwp_enqueue_scriptscom\classes\Actions.php:61
filtersgpbOtherConditionscom\classes\Actions.php:62
filtercron_schedulescom\classes\Actions.php:64
actionsgpb_send_newslettercom\classes\Actions.php:65
actionplugins_loadedcom\classes\Actions.php:67
actionpre_get_postscom\classes\Actions.php:69
actiontemplate_redirectcom\classes\Actions.php:70
filterviews_edit-popupbuildercom\classes\Actions.php:71
actionwpml_loadedcom\classes\Actions.php:72
actionthe_postcom\classes\Actions.php:73
filterupload_mimescom\classes\Actions.php:77
actionplugins_loadedcom\classes\Actions.php:78
filterwp_count_postscom\classes\Actions.php:80
actionwp_trash_postcom\classes\Actions.php:81
actionadmin_headcom\classes\Actions.php:132
actionadmin_footercom\classes\Actions.php:541
filterupload_dircom\classes\Actions.php:992
filterwp_handle_upload_prefiltercom\classes\Actions.php:993
filtersgpb_exclude_from_popups_listcom\classes\Actions.php:1746
filterupload_dircom\classes\Actions.php:1833
actionwp_nav_menu_item_custom_fieldscom\classes\components\Menu.php:37
actionwp_update_nav_menu_itemcom\classes\components\Menu.php:38
filternav_menu_css_classcom\classes\components\Menu.php:40
filterwp_setup_nav_menu_itemcom\classes\components\Menu.php:41
filtersgpbLoadablePopupscom\classes\components\Menu.php:42
filtersgpbConvertedPopupIdcom\classes\ConvertToNewVersion.php:1199
actioncurrent_screencom\classes\Feedback.php:10
filtersgpbAdminJsFilescom\classes\Feedback.php:19
actionadmin_footercom\classes\Feedback.php:20
filteradmin_urlcom\classes\Filters.php:33
filterwpseo_sitemap_exclude_post_typecom\classes\Filters.php:34
filteradmin_menucom\classes\Filters.php:35
filterpost_row_actionscom\classes\Filters.php:37
filtersgpbAdminJscom\classes\Filters.php:38
filtersgpbAdminCssFilescom\classes\Filters.php:39
filtersgpbPopupContentLoadToPagecom\classes\Filters.php:40
filterthe_contentcom\classes\Filters.php:41
actioninitcom\classes\Filters.php:43
filterpreview_post_linkcom\classes\Filters.php:44
filterupgrader_pre_downloadcom\classes\Filters.php:45
filtersgpbSavedPostDatacom\classes\Filters.php:46
filtersgpbPopupEventscom\classes\Filters.php:47
filtersgpbAdditionalMetaboxescom\classes\Filters.php:48
filtersgpbOptionAvailablecom\classes\Filters.php:49
filterexport_wp_filenamecom\classes\Filters.php:50
filtersgpbAdvancedOptionsDefaultValuescom\classes\Filters.php:51
filtersgpbPopupContentLoadToPagecom\classes\Filters.php:52
filtersgpbExtraNotificationscom\classes\Filters.php:53
filtersgpbSystemInformationcom\classes\Filters.php:54
filterplugin_action_linkscom\classes\Filters.php:55
filterplugin_row_metacom\classes\Filters.php:56
filterrank_math/sitemap/exclude_post_typecom\classes\Filters.php:57
filtersgpbUserSelectionQuerycom\classes\Filters.php:58
filtersgpbFilterOptionsBeforeSavingcom\classes\Filters.php:59
filtersgpbPopupExtraDatacom\classes\Filters.php:60
filterwpml_link_to_translationcom\classes\Filters.php:61
filterpll_get_post_typescom\classes\Filters.php:62
filterposts_wherecom\classes\Filters.php:387
filterwp_unique_filenamecom\classes\Filters.php:593
actionadmin_footercom\classes\MediaButton.php:101
filtersgpbCronTimeoutSettingscom\classes\NotificationCenter.php:21
actionsgpbGetNotificationscom\classes\NotificationCenter.php:22
actionadmin_headcom\classes\NotificationCenter.php:26
filtersgpbPopupRenderOptionscom\classes\popups\SubscriptionPopup.php:16
filtersgpbAdminJsFilescom\classes\popups\SubscriptionPopup.php:17
filtersgpbAdminCssFilescom\classes\popups\SubscriptionPopup.php:18
filtersgpbSubscriptionFormcom\classes\popups\SubscriptionPopup.php:19
filtersgpbFrontendJsFilescom\classes\popups\SubscriptionPopup.php:27
filtersgpbFrontendCssFilescom\classes\popups\SubscriptionPopup.php:29
filtersgpbPostTypeSupportcom\classes\RegisterPostType.php:136
filtersgpbAdditionalMetaboxescom\classes\RegisterPostType.php:225
filtersgpbAdditionalMetaboxescom\classes\RegisterPostType.php:230
actionwp_footercom\classes\ScriptsLoader.php:196
actionadmin_footercom\classes\ScriptsLoader.php:233
actionadmin_menucom\classes\Updates.php:35
actionadmin_initcom\classes\Updates.php:36
actionadmin_noticescom\classes\Updates.php:37
actionactivate_popup-builder/popup-builder.phpcom\config\config.php:147
filtersafe_style_csscom\helpers\AdminHelper.php:2616
filtersgPopupTargetParamscom\helpers\ConfigDataHelper.php:68
filtersgPopupTargetDatacom\helpers\ConfigDataHelper.php:69
filtersgPopupTargetTypescom\helpers\ConfigDataHelper.php:70
filtersgPopupTargetAttrscom\helpers\ConfigDataHelper.php:71
filtersgPopupPageTemplatescom\helpers\ConfigDataHelper.php:72
filtersgPopupTargetPostTypecom\helpers\ConfigDataHelper.php:73
filtersgPopupTargetPageTypecom\helpers\ConfigDataHelper.php:74
filtersgPopupTargetParamscom\helpers\ConfigDataHelper.php:1369
filtersgPopupTargetDatacom\helpers\ConfigDataHelper.php:1370
filtersgPopupTargetTypescom\helpers\ConfigDataHelper.php:1371
filtersgPopupTargetAttrscom\helpers\ConfigDataHelper.php:1372
filtersgPopupPageTemplatescom\helpers\ConfigDataHelper.php:1373
filtersgPopupTargetPostTypecom\helpers\ConfigDataHelper.php:1374
filtersgPopupTargetPageTypecom\helpers\ConfigDataHelper.php:1375
actionadmin_noticespopup-builder.php:34

Scheduled Events 2

sgpb_send_newsletter
sgpbGetNotifications
Maintenance & Trust

Popup Builder – Create highly converting, mobile friendly marketing popups. Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedJan 22, 2026
PHP min version5.3.3
Downloads11.8M

Community Trust

Rating94/100
Number of ratings2,206
Active installs200K
Developer Profile

Popup Builder – Create highly converting, mobile friendly marketing popups. Developer Profile

popupbuilder

3 plugins · 201K total installs

73
trust score
Avg Security Score
92/100
Avg Patch Time
523 days
View full developer profile
Detection Fingerprints

How We Detect Popup Builder – Create highly converting, mobile friendly marketing popups.

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/popup-builder/css/sgpb-style.css/wp-content/plugins/popup-builder/css/sgpb-admin-style.css/wp-content/plugins/popup-builder/js/sgpb-admin-script.js/wp-content/plugins/popup-builder/js/sgpb-popup-script.js/wp-content/plugins/popup-builder/js/sgpb-settings-script.js/wp-content/plugins/popup-builder/js/sgpb-preview-script.js/wp-content/plugins/popup-builder/js/sgpb-addons-script.js/wp-content/plugins/popup-builder/js/sgpb-categories-script.js+5 more
Script Paths
/wp-content/plugins/popup-builder/js/sgpb-admin-script.js/wp-content/plugins/popup-builder/js/sgpb-popup-script.js/wp-content/plugins/popup-builder/js/sgpb-settings-script.js/wp-content/plugins/popup-builder/js/sgpb-preview-script.js/wp-content/plugins/popup-builder/js/sgpb-addons-script.js/wp-content/plugins/popup-builder/js/sgpb-categories-script.js+5 more
Version Parameters
popup-builder/css/sgpb-style.css?ver=popup-builder/css/sgpb-admin-style.css?ver=popup-builder/js/sgpb-admin-script.js?ver=popup-builder/js/sgpb-popup-script.js?ver=popup-builder/js/sgpb-settings-script.js?ver=popup-builder/js/sgpb-preview-script.js?ver=popup-builder/js/sgpb-addons-script.js?ver=popup-builder/js/sgpb-categories-script.js?ver=popup-builder/js/sgpb-effects-script.js?ver=popup-builder/js/sgpb-custom-popup-type.js?ver=popup-builder/js/sgpb-templates-script.js?ver=popup-builder/js/sgpb-reports-script.js?ver=popup-builder/js/sgpb-feedback-script.js?ver=

HTML / DOM Fingerprints

CSS Classes
sgpb-tablesgpb-table-wrapsgpb-admin-wrapper
HTML Comments
<!-- SLIDER -->
Data Attributes
data-sgpb-iddata-sgpb-typedata-sgpb-delaydata-sgpb-popup-iddata-sgpb-hide-on-mobiledata-sgpb-show-on-mobile+2 more
JS Globals
SGPB_POPUP_VERSIONsgpbBackendSGPBAdminParams
REST Endpoints
/wp-json/sgpb/v1/popups
Shortcode Output
[sg_popup
FAQ

Frequently Asked Questions about Popup Builder – Create highly converting, mobile friendly marketing popups.