SQL Injection Vulnerability in Popup Builder Plugin for WordPress
CVE-2025-10862
7.5HIGH
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 October 2025
What is CVE-2025-10862?
The Popup Builder plugin for WordPress is susceptible to SQL Injection attacks due to insufficient escaping of the 'id' parameter and a lack of preparation in the SQL queries. This vulnerability allows unauthenticated attackers to inject additional SQL commands into existing queries, potentially exposing sensitive data stored in the database. All versions up to and including version 2.1.3 are affected, making it crucial for users to update their installations promptly to mitigate security risks.
Affected Version(s)
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers * <= 2.1.3