CVE-2026-100159
MediumCVSS 4.8Summary
The Popup Box plugin for WordPress versions 6.4.1 to 6.4.2 is vulnerable to Arbitrary Shortcode Execution. The ays_popup_get_user_ip() function reads client-controlled headers, sanitizes them only with sanitize_text_field(), substitutes the value into popup body where %%user_ip_address%% token appears, and passes the result to do_shortcode(), allowing unauthenticated attackers to execute arbitrary registered shortcodes.
Risk Assessment
An unauthenticated attacker can execute arbitrary shortcodes with attributes, potentially leading to data reading or other actions. This requires an administrator to have added the %%user_ip_address%% token to a popup's Custom Content body.
Recommendation
Update the Popup Box plugin to a version later than 6.4.2. Remove the %%user_ip_address%% token from popup bodies until patched.
Related vulnerabilities
- CVE-2026-111472Critical
An SQL injection vulnerability has been discovered in TSG Profleet. An attacker could retrieve, create, update and delete data from the database by sending a GET request using the 'Identificación' parameter of the '/cgi-bin/index.php' endpoint.
- CVE-2026-94388Critical
The Green Popups plugin (halfdata-green-popups) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The vulnerability allows an attacker to perform Blind SQL Injection.
- CVE-2026-94169Critical
The Grid plugin (the-grid) contains a Code Injection vulnerability due to improper control of code generation. The vulnerability allows an attacker to perform Command Injection.
- CVE-2026-104730Critical
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object, but with no known POP chain in the vulnerable software, it has no impact unless another plugin or theme with a POP chain is installed.
- CVE-2026-89079Critical
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password, allowing unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
- CVE-2026-103768Critical
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments, allowing unauthenticated attackers to upload files that may be executable, making remote code execution possible.
- CVE-2026-109515Critical
The MailOptin plugin for WordPress (versions up to and including 1.2.78.6) is vulnerable to privilege escalation. The subscribe_to_email_list endpoint accepts the optin_data[form_custom_field_mappings] parameter without validation, allowing an attacker to override the administrator's mapping and pass arbitrary wp_users columns (including ID and user_pass) to wp_insert_user().
- CVE-2026-109219Critical
The Mang Board plugin for WordPress (versions up to and including 2.4.4) is vulnerable to arbitrary file upload via the mbw_file_upload function. Missing file extension validation on the image_path parameter allows unauthenticated attackers to upload executable files, enabling remote code execution.
- CVE-2026-104798Critical
The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.
- CVE-2026-111444Critical
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. This includes opt-in parameterize=false queries, IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments, and LIKE ESCAPE literals.
Original NVD description (English source)
The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS