Is CVE-2019-25744 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25744 being exploited in the wild.

How severe is CVE-2019-25744?

Medium severity, with a CVSS score of 6.4, published 4 June 2026.

Is there a fix for CVE-2019-25744?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25744 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-25744?

Check whether you run Sygnoos Popup Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25744: Sygnoos Popup Builder persistent XSS in post_title

CVE-2019-25744 · Severity: medium · CVSS 6.4 · Published 2026-06-04

Popup Builder is a popular WordPress plugin used to create and manage marketing popups on websites. A security vulnerability in version 3.49 allows an attacker with basic account access to inject malicious scripts into the website. These scripts execute automatically when other users or administrators view certain pages, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: Sygnoos Popup Builder. Vendors: Sygnoos.

Quick answers

Is CVE-2019-25744 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25744 being exploited in the wild.
How severe is CVE-2019-25744?: Medium severity, with a CVSS score of 6.4, published 4 June 2026.
Which products and versions are affected?: Sygnoos Popup Builder 3.49.
Is there a fix for CVE-2019-25744?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25744 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-25744?: Check whether you run Sygnoos Popup Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A persistent cross-site scripting (XSS) vulnerability exists in WordPress Popup Builder 3.49 due to improper neutralization of input in the 'post_title' parameter. An authenticated attacker can submit a crafted POST request to the 'post.php' endpoint containing a script payload that breaks out of HTML <option> tags. This payload is stored in the database and executes whenever an administrator or user visits the 'Add New' page or post sections where popup selections are displayed. The vulnerability is triggered because the plugin fails to sanitize the popup title before rendering it within the selection interface of the WordPress administrative dashboard.

Affected products

Sygnoos Popup Builder 3.49

Timeline

2019-06-13: disclosed: Initial discovery by researcher
2019-10-17: other: Exploit published on Exploit-DB
2026-06-04: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.