Pop-up

Pop-up has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 5 are fixed as of September 2026. Their average CVSS score is 5.1, and the most serious one scores 7.1 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF), Improper Privilege Management.

Every one of the 5 issues recorded for Pop-up has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (2) reported by Chloe Chamberland. Pop-up is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

5.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Pop-up vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.1

Pop-up <= 1.1.1 - Missing authorization to Settings Change

Read the full analysis

Vulnerability Records

5 records


2024-04-10 00:00	Inisev Analyst Module <= Various Versions - Missing Authorization Pop-up <= 1.2.3	`CVE-2024-31435`	4.3 Medium	Dhabaleshwar Das	Yes
2023-07-27 00:00	Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function Pop-up <= 1.1.9	`CVE-2023-3977`	4.3 Medium	Chloe Chamberland	Yes
2023-07-27 00:00	Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function Pop-up <= 1.1.9	`CVE-2023-0958`	4.3 Medium	Chloe Chamberland	Yes
2022-09-02 00:00	Pop-up <= 1.1.5 - Privilege Escalation Pop-up <= 1.1.5	`CVE-2022-38070`	5.4 Medium	Tien Nguyen Ahn	Yes
2022-08-08 00:00	Pop-up <= 1.1.1 - Missing authorization to Settings Change Pop-up <= 1.1.1	`N/A`	7.1 High	Anonymous	Yes

Showing 1–5 of 5 reports

Latestv1.2.9

Pop-up

Author

Inisev

4.7(85)

94/100

Last Updated

2026-08-28 (16d ago)

Active Installs

10,000+

Downloads

365,264

Requires WP

4.6+

Requires PHP

5.6+

Tested up to

WP 7.1

Created

2020-11-07 (6y ago)

Try it out on your free dummy site: Click here => https://tastewp.com/plugins/pop-up-pop-up. (this trick works for all plugins in the WP repo – just replace “wordpress” with “tastewp” in the URL) Create stunning pop-ups in a breeze! This plugin allows you (in combination with MyPopUps.com) to place cool-looking pop-ups on your site for various purposes: Collect emails Show discount codes Get social likes & shares Show cookie notices Block ad-blockers You can design the pop-ups to your liking thanks to the powerful builder on MyPopUps. You can activate & disable the pop-ups directly inside this plugin (without having to leave your WP dashboard)! Coming soon: define much more granular rules when & how the pop-ups should show (using WordPress parameters, inside this plugin). Give it a shot! If you find any ways how to improve it, please let us know in the support forum, we’ll always try to respond quickly 🙂 Note: This plugin relies on the 3rd party service MyPopUps, which can be reached at https://mypopups.com. The pop-ups are created on MyPopUps and displayed on your website with the help of this plugin. Only when you click on the “Yes” button in the plugin a connection is established to MyPopUps (this is also mentioned on that button). For the confidential handling of your data, please have a look at MyPopUps’ GDPR-compliant privacy policy at https://mypopups.com/privacy as well at the terms of use at https://mypopups.com/terms. If you have any questions about those, please don’t hesitate to contact us here https://mypopups.com/contact-us. Thank you!

View on WordPress.org