CVE-2026-57631
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
SQL Injection vulnerability in Popup box versions up to 6.0.1 allows an administrator to inject malicious SQL code. An attacker with admin privileges can manipulate database queries.
Risk Assessment
The risk involves unauthorized access, modification, or deletion of data by an administrator, potentially compromising system integrity and confidentiality.
Recommendation
Immediately update the Popup box component to a version later than 6.0.1 where the vulnerability is patched.
Other vulnerabilities in Popup box <= 6.0.1
See all- CVE-2026-54192High
Popup box versions up to 6.2.9 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
- CVE-2025-69021Medium
Cross-Site Request Forgery (CSRF) vulnerability in Popup box (WordPress plugin) allows an attacker to force a logged-in user to perform unwanted actions. Affects versions up to and including 6.0.7.
- CVE-2025-57931Medium
The Popup box plugin for WordPress (versions up to 5.5.4) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions.
Original NVD description (English source)
Administrator SQL Injection in Popup box <= 6.0.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS