ConvertForce: Popup, Notification Bar & Slide-in Builder
ConvertForce: Popup, Notification Bar & Slide-in Builder has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for ConvertForce: Popup, Notification Bar & Slide-in Builder has a vendor fix available, so running the current release closes it.
All of these findings were reported by Athiwat Tiprasaharn (Jitlada). ConvertForce: Popup, Notification Bar & Slide-in Builder is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-14506ConvertForce Popup Builder <= 0.0.7 - Stored Cross-Site Scripting via entrance_animation
Read the full analysisVulnerability Records

ConvertForce: Popup, Notification Bar & Slide-in Builder
Author
Imtiaz Rayhan
ConvertForce is a popup builder for WordPress that uses the WordPress block editor. Campaigns get their own screen under the ConvertForce menu, and you build them with the same blocks, the same styling controls, and the same sidebar you already use for posts and pages. There is no separate drag and drop builder to learn and no page builder required. Most popup plugins hand you a locked-down drag and drop canvas with its own widgets, its own styling panel, and its own way of doing everything. ConvertForce does not. If you can build a page in WordPress, you can build a popup in ConvertForce. What you can build Popups and lightbox modals Notification bars and announcement bars (top or bottom, sticky or static) Slide-in boxes and corner popups Floating buttons and sticky call-to-action buttons Cookie notices and cookie consent bars Free shipping bars and promo bars for WooCommerce stores Email newsletter signup popups (using Custom HTML block) Discount and coupon code popups Exit intent offers and cart abandonment popups Black Friday, Cyber Monday, and seasonal sale campaigns Important notice popups Support and contact prompts Three display types Every campaign starts by choosing one of three display types: Notification Bar: a full width notification bar pinned to the top or bottom of the screen. Good for announcements, shipping offers, cookie notices, and site-wide alerts. Lightbox Popup: a centered popup over a dimmed backdrop. Good for offers, signups, and messages that need full attention. Slide-In Popup: a small box that slides in from a corner. Good for nudges, support prompts, and floating buttons that should not interrupt reading. You can switch a campaign from one type to another at any time without rebuilding it. 15 ready-made patterns, or start from scratch Each display type comes with pre-built patterns you can insert and edit: Notification Bar Patterns: Cookie Bar, Free Shipping Bar, Halloween Sale Bar, New Year Sale Bar, Sale Notification Bar Lightbox Popup Patterns: Black Friday, Halloween Sale, Important Notice, New Arrival, Simple Popup Slide-in Popup Patterns: Customer Support, Cyber Monday, Halloween Treat, Owner’s Pick, Summer Sale Every pattern is made of regular WordPress blocks, so you can change the text, colors, images, and layout with the normal editor controls. Triggers: decide when the popup appears Page Load (free): show the campaign as soon as the page opens. Exit Intent (Pro): show it when the visitor moves to leave the tab or close the window. Scroll Depth (Pro): show it after the visitor scrolls a set distance down the page. Time on Page (Pro): show it after a set number of seconds. User Inactivity (Pro): show it after the visitor stops interacting for a set number of seconds. Display conditions: decide where it appears Set a campaign to Show on or Hide on specific parts of your site. Target the entire site, singular content (individual posts, pages, or custom post types), or archives (categories, tags, author and date archives). Stack multiple conditions on one campaign to get exactly the audience you want. Advanced Targeting (Pro) adds 37 further conditions across 8 categories, including browser, device, operating system, referrer, URL parameters, cookies, on-page HTML, and logged-in user state. Behavior: decide how often it appears Display frequency: every page load, once per session, or a custom interval in days (Pro). When closed: keep showing, hide forever, or hide for a custom number of days (Pro). Dismissal and frequency state is stored locally in the visitor’s browser. Nothing is sent to any external service. Countdown timers (Pro) Add urgency to any campaign with the Countdown block: Fixed: count down to a date and time in your site timezone. Everyone sees the same deadline. Evergreen: a per-visitor timer that starts the first time each visitor sees it, with an optional restart for returning visitors. Recurring: a countdown that repeats on a schedule, for example every day or every week. Pick from five timer styles, choose which units and labels to show, and decide what happens when the timer ends: keep it at zero, hide it, show a message, or close the whole campaign. Full design control Because campaigns are built with blocks, you get real design control instead of a handful of preset themes: Padding, margin, border, and border radius Background color, gradient, and image Box shadow and backdrop blur Minimum height and maximum width Flex or grid layout with justification, alignment, and item gap Separate settings for desktop, tablet, and mobile, with a device preview in the editor Position control (top, center, bottom) with pixel offset Full close button control: icon or text, icon size, floating or static, corner placement, and offsets Optional close on backdrop click Text block with Google Fonts, so headings and body copy can use any Google font without a separate plugin Accessible by default: popups announce themselves to screen readers, keep keyboard focus inside while open, return focus to where the visitor left off, close with the Escape key, and respect reduced motion settings Lightweight and privacy friendly ConvertForce loads only the assets a campaign actually needs. There is no page builder framework, no jQuery dependency chain, and no bloat. It is fully self-hosted: no third-party scripts, no tracking pixels, and no visitor identifiers sent anywhere. That makes it a good fit for sites with strict privacy or GDPR requirements. Works with what you already use Any block theme or classic theme Any core WordPress block, plus blocks from other block plugins Email and form services, embedded with the core Custom HTML block WooCommerce stores, for sale bars, shipping bars, and promo popups Caching and performance plugins Free vs ConvertForce Pro Free includes: all three display types, all 15 patterns, the full block-based designer, responsive controls, page load trigger, display conditions, and basic frequency and dismissal rules. Pro adds: exit intent, scroll depth, time on page, and user inactivity triggers, custom display frequency and custom hide duration, a countdown timer block, and 37 advanced targeting conditions. Learn more about ConvertForce Pro | Documentation Who ConvertForce is for Bloggers who want a newsletter popup that matches their site design WooCommerce stores running shipping bars, discount popups, and seasonal sales Agencies that want clients to edit popup content themselves without a new interface to learn Anyone who wants a fast, block-native alternative to heavy popup plugins Anyone who wants a call to action that appears at the right moment instead of sitting in a side No coding needed. Install it, pick a display type, choose a pattern, set a trigger, and publish.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C