CVE-2022-0214 json
Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service
published 2022-02-14 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-15416
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
Patch / fix
- Unknown Popup | Custom Popup Builder 1.3.1
Exploit prediction
1.59% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- Unknown Popup | Custom Popup Builder
Classification
- Weakness
-
- CWE-1284 Improper Validation of Specified Quantity in Input
- Technology feeds
References
-
wpscan.com
/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4
exploit, vdb-entry, technical-description, third-party-advisory
Sources
- CVE List CVE-2022-0214
- NVD CVE-2022-0214
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.