high·Product Based Web Vulnerabilities·Updated Dec 18, 2025

WordPress Popup Builder < 4.0.7 - Remote Code Execution

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2021-25082

8.8

CVSS

Description

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR

Attack Vector

Privileges Req.

User Interaction

Affected

Popup Builder – Create highly converting, mobile friendly marketing popups.

AFFECTED< 4.0.7→SAFE ✓≥ 4.0.7

Updated Nov 10, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

WordPress Popup Builder < 4.0.7 - Remote Code Execution

Check your infrastructure.Right now.

Check your infrastructure.
Right now.