Easy Modal
Easy Modal has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 6.9, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high. 2017 was the busiest year with 2 disclosures.
The most common weakness is SQL Injection, behind 2 of the records (67%). Other recurring categories include Cross-Site Scripting.
Every one of the 3 issues recorded for Easy Modal has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Easy Modal is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2017-12946Easy Modal < 2.1.0 - Authenticated (Admin+) SQL Injection
Read the full analysisVulnerability Records

Easy Modal
Author
Daniel Iser
Easy Modal lets site administrators create modal windows, style them with reusable themes, and open them from links, buttons, or images. Features include: Unlimited modals and themes. Rich modal content with WordPress shortcodes. Responsive presets and custom dimensions. Configurable position, animation, overlay, and close behavior. Sitewide loading or selection on individual posts and pages. Automatic Gravity Forms asset loading when Gravity Forms is available. All functionality included in this plugin is available without a license key, quota, trial period, or paid unlock. Moving to Popup Maker Easy Modal remains fully functional, but Popup Maker is its actively developed successor. Popup Maker includes modern targeting, triggers, cookies, accessibility improvements, and an importer that converts existing Easy Modal modals and themes while preserving legacy trigger classes through compatibility mode. Read the Easy Modal migration guide, then install Popup Maker when you are ready to migrate. You can also review the first-popup guide and trigger guide. Opening a modal Each saved modal has a trigger class such as eModal-12. Add that class to a link, button, or image: <button type="button" class="eModal-12">Open modal</button> Replace 12 with the modal ID shown in the Easy Modal administration screen. Inline modal shortcode The [modal] shortcode renders a modal directly from post content. For example: [modal id="newsletter" title="Join our newsletter"]Your form shortcode here.[/modal] Open it with an element whose class matches the generated modal ID: <button type="button" class="eModal-newsletter">Open newsletter</button> Privacy and external services Easy Modal does not send site data to the plugin author or to an external service. It does not load remote scripts, styles, images, fonts, analytics, advertisements, license checks, or update metadata. If modal content contains a shortcode or embed supplied by another plugin or by WordPress, that content may use external services according to the behavior and privacy policy of that separate component.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C