CVE-2022-0214

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1284

Affected software

Vendor	Product	Versions
Unknown	Popup \| Custom Popup Builder	< 1.3.1

References

https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4Exploit, Third Party Advisory
https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4Exploit, Third Party Advisory

Timeline

Published: Feb 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-02158.8The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vu CVE-2022-02164.4A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeate CVE-2022-02177.5It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in pars CVE-2022-02186.1The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme s CVE-2022-02195.5Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.CVE-2022-02206.1The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authentic CVE-2022-02215.5A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when openi CVE-2022-02227.5A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the cont CVE-2022-02239.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker t CVE-2022-02249.8dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command CVE-2022-02255.4A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new gro CVE-2022-02264.3livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)