title: Popup Builder < 4.0.7 - Admin+ SQL Injection
description: The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
problem types: CWE-89 SQL Injection
affected:
{
product: Popup Builder – Create highly converting, mobile friendly marketing popups.
vendor: Unknown
versions:
lessThan: 4.0.7, status: affected, version: 4.0.7, versionType: custom
}