Update the WordPress Popup Builder plugin to the latest available version (at least 4.1.11).
Pritam Dash discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Popup Builder Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.1.11.
CrossSite Request Forgery (CSRF) leading to plugin settings update
CrossSite Request Forgery (CSRF) vulnerability leading to Popup Status Change
SQL Injection (SQLi) vulnerability to Reflected CrossSite Scripting (XSS)
Local File Inclusion (LFI) leading to Remote Code Execution (RCE)
SQL Injection (SQLi) vulnerability