CVE-2022-0228 describes a SQL injection vulnerability in the Popup Builder WordPress plugin prior to version 4.0.7. High-privilege users can exploit this flaw due to insufficient validation and escaping of the 'orderby' and 'order' parameters in the admin dashboard. This vulnerability carries a CVSS v3.1 score of 7.2 (HIGH), indicating a network-based attack with low complexity that can lead to high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, and while Nuclei templates exist, there are no Metasploit modules or ExploitDB entries, and community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.0.7CPE matchmatch criteria | cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.