Easy Modal

Easy Modal has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 6.9, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high. 2017 was the busiest year with 2 disclosures.

The most common weakness is SQL Injection, behind 2 of the records (67%). Other recurring categories include Cross-Site Scripting.

Every one of the 3 issues recorded for Easy Modal has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Easy Modal is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Easy Modal vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2017-12946

Easy Modal < 2.1.0 - Authenticated (Admin+) SQL Injection

Read the full analysis

Vulnerability Records

3 records
Easy Modal banner
Latestv2.2.1
4.4(124)
88/100
Last Updated
2026-09-09 (2mo ago)
Active Installs
7,000+
Downloads
244,556
Requires WP
6.3+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2011-05-29 (16y ago)

Easy Modal lets site administrators create modal windows, style them with reusable themes, and open them from links, buttons, or images. Features include: Unlimited modals and themes. Rich modal content with WordPress shortcodes. Responsive presets and custom dimensions. Configurable position, animation, overlay, and close behavior. Sitewide loading or selection on individual posts and pages. Automatic Gravity Forms asset loading when Gravity Forms is available. All functionality included in this plugin is available without a license key, quota, trial period, or paid unlock. Moving to Popup Maker Easy Modal remains fully functional, but Popup Maker is its actively developed successor. Popup Maker includes modern targeting, triggers, cookies, accessibility improvements, and an importer that converts existing Easy Modal modals and themes while preserving legacy trigger classes through compatibility mode. Read the Easy Modal migration guide, then install Popup Maker when you are ready to migrate. You can also review the first-popup guide and trigger guide. Opening a modal Each saved modal has a trigger class such as eModal-12. Add that class to a link, button, or image: <button type="button" class="eModal-12">Open modal</button> Replace 12 with the modal ID shown in the Easy Modal administration screen. Inline modal shortcode The [modal] shortcode renders a modal directly from post content. For example: [modal id="newsletter" title="Join our newsletter"]Your form shortcode here.[/modal] Open it with an element whose class matches the generated modal ID: <button type="button" class="eModal-newsletter">Open newsletter</button> Privacy and external services Easy Modal does not send site data to the plugin author or to an external service. It does not load remote scripts, styles, images, fonts, analytics, advertisements, license checks, or update metadata. If modal content contains a shortcode or embed supplied by another plugin or by WordPress, that content may use external services according to the behavior and privacy policy of that separate component.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C