POPUP Zyrex
POPUP Zyrex has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 1 of the records (100%).
The one issue recorded for POPUP Zyrex has a vendor fix available, so running the current release closes it.
All of these findings were reported by Yogesh Verma. POPUP Zyrex is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2023-0924Zyrex Popup <= 1.0 - Authenticated (Admin+) Arbitrary File Upload
Read the full analysisVulnerability Records
POPUP Zyrex
Author
Zyrex
POPUP Zyrex is a simple, lightweight and modern plugin that lets you display popups (banners) on your WordPress site. Increase conversions — announce promotions, newsletter sign-ups, events or new arrivals. Available in 6 languages: English, Polski, Deutsch, Français, Español, Italiano. Features: Two content types: image banner or HTML/text with headline, body and CTA button. 3 trigger types: after time, after scroll, exit-intent (attempt to leave the page). 5 positions: modal (center), bottom-right/bottom-left slide-in corner, top bar, bottom bar. Scheduling: optional start/end date — popup turns on and off automatically (e.g. Black Friday). Targeting: whole site, specific page, all entries of a post type (pages/posts/products), posts in category or with tag, device (desktop/mobile), user state (logged-in/logged-out). Built-in analytics: views, clicks, closes, CTR — global and per popup. WordPress Media Library integration. Color picker for the close-button and CTA accent. Lightweight frontend (~4 KB JS + CSS) — no jQuery dependency. Security: nonces, capability checks, prepared statements, input sanitization, wp_kses_post on HTML bodies. Other features: Configurable hide-after-close cookie duration. Open/close animations with prefers-reduced-motion support. Accessibility: ESC to close, aria-modal, focus-visible on buttons. Multiple popups running simultaneously with independent rules. Translation-ready (text domain popup-zyrex) — bundled translations for English, Polish, German, French, Spanish, Italian. Uninstall drops all plugin data cleanly. Author: zyrex.pl
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C