Popup Box Create Countdown Coupon Video Contact Form Popups
Monthly
Arbitrary shortcode execution in the Popup Box plugin for WordPress (ays-pro) versions 6.4.1 through 6.4.2 lets unauthenticated remote attackers invoke any shortcode registered on the site with attacker-chosen attributes, because client-controlled IP-related HTTP headers are folded into a popup body and then run through do_shortcode(). The attack is only reachable when a site administrator has manually inserted the %%user_ip_address%% token into a popup's Custom Content body, so default installations and sites that never use that token are not affected; impact is bounded by the shortcodes already installed (no direct PHP injection), which is why the assessed vector scores only 4.8 with high attack complexity. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor reference points to a fix in 6.4.3.
Arbitrary shortcode execution in the Popup Box plugin for WordPress (ays-pro) versions 6.4.1 through 6.4.2 lets unauthenticated remote attackers invoke any shortcode registered on the site with attacker-chosen attributes, because client-controlled IP-related HTTP headers are folded into a popup body and then run through do_shortcode(). The attack is only reachable when a site administrator has manually inserted the %%user_ip_address%% token into a popup's Custom Content body, so default installations and sites that never use that token are not affected; impact is bounded by the shortcodes already installed (no direct PHP injection), which is why the assessed vector scores only 4.8 with high attack complexity. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor reference points to a fix in 6.4.3.