ays-pro Vulnerabilities and Affected Products
Vulnerabilities associated with Popup Box – Create Countdown, Coupon, Video, Contact Form Popups.
Products
Clear product- Poll Maker – Versus Polls, Anonymous Polls, Image Polls8 vulnerabilities
- Quiz Maker6 vulnerabilities
- Secure Copy Content Protection and Content Locking5 vulnerabilities
- Survey Maker5 vulnerabilities
- AI ChatBot with ChatGPT and Content Generator by AYS3 vulnerabilities
- Popup Box – Create Countdown, Coupon, Video, Contact Form Popups3 vulnerabilities
- popup_box3 vulnerabilities
- secure_copy_content_protection_and_content_locking3 vulnerabilities
- ai_chatbot_with_chatgpt2 vulnerabilities
- Chartify – WordPress Chart Plugin2 vulnerabilities
- poll_maker2 vulnerabilities
- quiz_maker2 vulnerabilities
- chartify1 vulnerability
- FAQ Builder AYS1 vulnerability
- Fox LMS – WordPress LMS Plugin1 vulnerability
- Image Slider by Ays- Responsive Slider and Carousel1 vulnerability
- Photo Gallery by Ays – Responsive Image Gallery1 vulnerability
- Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls1 vulnerability
- Quiz Maker by AYS1 vulnerability
- survey_maker1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-1165MEDIUM | Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status ChangeThe Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish status of popups via a forged request, granted they can trick a site administrator into performing an action such as clicking a link. CWE-352Jan 31, 2026 | CVSS4.3v3.1 | EPSS0.165% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-10861MEDIUM | Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options UpdateThe Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data. CWE-862Nov 16, 2024 | CVSS5.3v3.1 | EPSS0.378% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-3897MEDIUM | Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information ExposureThe Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on the website. CWE-862May 2, 2024 | CVSS5.3v3.1 | EPSS0.623% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |