CVE

CVE-2021-25082

8.8

CVSS

Description

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR

Attack Vector

Privileges Req.

User Interaction

popup builder – create highly converting, mobile friendly marketing popups.

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

WordPress Popup Builder < 4.0.7 - Remote Code Execution

Popup Builder WordPress plugin before 4.0.7 contains a local file inclusion caused by unsanitized 'sgpb_type' parameter in require statement, letting attackers include arbitrary local files or execute code via wrappers like PHAR, exploit requires attacker to control 'sgpb_type' parameter. References: https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132/ https://nvd.nist.gov/vuln/detail/CVE-2021-25082 Remediation: Update to version 4.0.7 or later

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: popup builder – create highly converting, mobile friendly marketing popups.

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →