ConvertForce: Popup, Notification Bar & Slide-in Builder

ConvertForce: Popup, Notification Bar & Slide-in Builder has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for ConvertForce: Popup, Notification Bar & Slide-in Builder has a vendor fix available, so running the current release closes it.

All of these findings were reported by Athiwat Tiprasaharn (Jitlada). ConvertForce: Popup, Notification Bar & Slide-in Builder is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all ConvertForce: Popup, Notification Bar & Slide-in Builder vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-14506

ConvertForce Popup Builder <= 0.0.7 - Stored Cross-Site Scripting via entrance_animation

Read the full analysis

Vulnerability Records

1 records
ConvertForce: Popup, Notification Bar & Slide-in Builder banner
Latestv1.2.0

ConvertForce: Popup, Notification Bar & Slide-in Builder

Imtiaz Rayhan

Author

Imtiaz Rayhan

5.0(2)
100/100
Last Updated
2026-09-07 (5d ago)
Active Installs
100+
Downloads
2,187
Requires WP
6.1+
Requires PHP
7.0+
Tested up to
WP 7.1
Created
2025-08-16 (1y ago)

ConvertForce is a popup builder for WordPress that uses the WordPress block editor. Campaigns get their own screen under the ConvertForce menu, and you build them with the same blocks, the same styling controls, and the same sidebar you already use for posts and pages. There is no separate drag and drop builder to learn and no page builder required. Most popup plugins hand you a locked-down drag and drop canvas with its own widgets, its own styling panel, and its own way of doing everything. ConvertForce does not. If you can build a page in WordPress, you can build a popup in ConvertForce. What you can build Popups and lightbox modals Notification bars and announcement bars (top or bottom, sticky or static) Slide-in boxes and corner popups Floating buttons and sticky call-to-action buttons Cookie notices and cookie consent bars Free shipping bars and promo bars for WooCommerce stores Email newsletter signup popups (using Custom HTML block) Discount and coupon code popups Exit intent offers and cart abandonment popups Black Friday, Cyber Monday, and seasonal sale campaigns Important notice popups Support and contact prompts Three display types Every campaign starts by choosing one of three display types: Notification Bar: a full width notification bar pinned to the top or bottom of the screen. Good for announcements, shipping offers, cookie notices, and site-wide alerts. Lightbox Popup: a centered popup over a dimmed backdrop. Good for offers, signups, and messages that need full attention. Slide-In Popup: a small box that slides in from a corner. Good for nudges, support prompts, and floating buttons that should not interrupt reading. You can switch a campaign from one type to another at any time without rebuilding it. 12 ready-made patterns, or start from scratch Each display type comes with pre-built patterns you can insert and edit: Notification Bar Patterns: Cookie Bar, Free Shipping Bar, New Year Sale Bar, Sale Notification Bar Lightbox Popup Patterns: Black Friday, Important Notice, New Arrival, Simple Popup Slide-in Popup Patterns: Customer Support, Cyber Monday, Owner’s Pick, Summer Sale Every pattern is made of regular WordPress blocks, so you can change the text, colors, images, and layout with the normal editor controls. Triggers: decide when the popup appears Page Load (free): show the campaign as soon as the page opens. Exit Intent (Pro): show it when the visitor moves to leave the tab or close the window. Scroll Depth (Pro): show it after the visitor scrolls a set distance down the page. Time on Page (Pro): show it after a set number of seconds. User Inactivity (Pro): show it after the visitor stops interacting for a set number of seconds. Display conditions: decide where it appears Set a campaign to Show on or Hide on specific parts of your site. Target the entire site, singular content (individual posts, pages, or custom post types), or archives (categories, tags, author and date archives). Stack multiple conditions on one campaign to get exactly the audience you want. Advanced Targeting (Pro) adds 37 further conditions across 8 categories, including browser, device, operating system, referrer, URL parameters, cookies, on-page HTML, and logged-in user state. Behavior: decide how often it appears Display frequency: every page load, once per session, or a custom interval in days (Pro). When closed: keep showing, hide forever, or hide for a custom number of days (Pro). Dismissal and frequency state is stored locally in the visitor’s browser. Nothing is sent to any external service. Full design control Because campaigns are built with blocks, you get real design control instead of a handful of preset themes: Padding, margin, border, and border radius Background color, gradient, and image Box shadow and backdrop blur Minimum height and maximum width Flex or grid layout with justification, alignment, and item gap Separate settings for desktop, tablet, and mobile, with a device preview in the editor Position control (top, center, bottom) with pixel offset Full close button control: icon or text, icon size, floating or static, corner placement, and offsets Optional close on backdrop click Text (CF) block with font family control including Google Fonts Lightweight and privacy friendly ConvertForce itself adds no tracking pixels and sends no visitor identifiers anywhere. Dismissal and frequency state stays in the visitor’s browser. The one exception is optional: if you use the Text (CF) block and select a Google Font, that font loads from Google’s servers like any other Google Font on your site. Built with accessibility in mind Popups use proper dialog semantics so screen readers announce them correctly Focus moves into the campaign when it opens and returns to where the visitor was when it closes Visitors can close any campaign with the Escape key or the close button Animations respect the visitor’s reduced motion setting Because campaigns are built from WordPress blocks, the accessibility built into those blocks carries over Works with what you already use Any block theme or classic theme Any core WordPress block, plus blocks from other block plugins Email and form services, embedded with the core Custom HTML block WooCommerce stores, for sale bars, shipping bars, and promo popups Caching and performance plugins Free vs ConvertForce Pro Free includes: all three display types, all 12 patterns, the full block-based designer, responsive controls, page load trigger, display conditions, and basic frequency and dismissal rules. Pro adds: exit intent, scroll depth, time on page, and user inactivity triggers, custom display frequency and custom hide duration, and 37 advanced targeting conditions. Learn more about ConvertForce Pro | Documentation Who ConvertForce is for Bloggers who want a newsletter popup that matches their site design WooCommerce stores running shipping bars, discount popups, and seasonal sales Agencies that want clients to edit popup content themselves without a new interface to learn Anyone who wants a fast, block-native alternative to heavy popup plugins Anyone who wants a call to action that appears at the right moment instead of sitting in a side No coding needed. Install it, pick a display type, choose a pattern, set a trigger, and publish.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C