PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
high·Product Based Web Vulnerabilities·Updated Dec 18, 2025

WordPress Popup Builder < 4.0.7 - Remote Code Execution

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
2.4k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2021-25082
8.8
CVSS

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR

Attack Vector
-
Privileges Req.
-
User Interaction
-
Affected
Popup Builder – Create highly converting, mobile friendly marketing popups.
AFFECTED< 4.0.7→SAFE ✓≥ 4.0.7
Updated Sep 9, 2026View on NVD →
Similar Tools
medium
Wordpress Jetpack plugin - Server Side Request Forgery
→critical
WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation
→critical
WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection
→high
WordPress Collapsing Categories <= 3.0.8 - SQL Injection
→high
WordPress Backup Migration <= 1.3.6 - Path Traversal
→medium
WordPress Qubely < 1.8.6 - Unauthenticated Email Sending
→medium
WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery
→critical
WordPress Realtyna Organic IDX Plugin <= 4.14.4 - Unauthenticated SQL Injection
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

WordPress Popup Builder < 4.0.7 - Remote Code Execution CVE-2021-25082 Scanner | S4E