Vulnerability Intelligence Report
Advanced Popups <= 1.1.1 - Cross-Site Request Forgery Bypass
CVE-2021-4421
The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the metabox_popup_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
No Active Exploit Signals
CVSS Base Score
4.3
MEDIUM
Exploitability:2.9
Impact Score:1.5
EPSS Probability:0.35%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-352 ↗CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| codesupplyco | Advanced Popups | 0 <= 1.1.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.350%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Wordfence · Vendor · USA |
| Reserved | 2023-07-11T18:19:10 |
| Published | 2023-07-12T06:52:34 |
| Last Updated | 2026-04-08T17:27:48 |
Community Chatter & Buzz