/Vulnerability Library

WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery

CVE-2022-29495
Verified

Description

Sygnoos Popup Builder plugin <= 4.1.11 for WordPress contains a cross-site request forgery caused by lack of CSRF protection in plugin settings update, letting attackers change settings without authorization, exploit requires victim to visit malicious site or click malicious link.

Severity

Medium

Published Date

February 6, 2026

Template Author

shivam kamboj

CVE-2022-29495.yaml
5.0Severity

CVSS Metrics

References

https://nvd.nist.gov/vuln/detail/CVE-2022-29495https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-11-cross-site-request-forgery-csrf-leading-to-plugin-settings-update

Remediation Steps

Implement CSRF tokens and verify requests properly, update to the latest plugin version.