Popup Builder - XSS (CVE-2023-6000)
Description
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
psychologyCrowdSec Analysis
CVE-2023-6000 is a vulnerability in the Popup Builder WordPress plugin prior to version 4.2.3 that allows unauthenticated visitors to modify existing popups and inject arbitrary JavaScript, resulting in stored cross-site scripting (XSS) attacks. This flaw could enable attackers to execute malicious scripts in the browsers of site visitors, potentially leading to data theft or session hijacking.
CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-6000 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the Popup Builder plugin by sending unauthenticated POST requests to the WordPress root endpoint with parameters like sgpb-is-preview, post_ID, and sgpb-WillOpen containing malicious JavaScript, resulting in stored XSS on vulnerable sites.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-01-01 |
| Rule Released | 2025-09-24 |
| CrowdSec First Seen | 2025-12-17 |