FireBox Popups – Increase Sales and Grow Your Email List
FireBox Popups creates popups and promotional overlays for displaying content and collecting visitor responses.
FireBox Popups – Increase Sales and Grow Your Email List (firebox) is a WordPress plugin with 3 published CVE records in this archive. The latest tracked vulnerability was published Sep 09, 2026; the highest published CVSS base score is 8.8.
fireboxCVE-2026-76801: FireBox permits author-level code execution through PHP condition rules
FireBox through 3.1.10 stores unsanitized PHP condition-rule values through the firebox_meta REST endpoint. When the value function evaluates them, the regex blacklist in Executer::allowedToRun() fails to prevent dangerous function calls, allowing server-side code execution. On sites upgraded from a version before 3.1.10, Migrator::preserveCampaignRoleAccess() grants Authors edit_fireboxes and publish_fireboxes, making those Author accounts able to reach the vulnerable functionality.
| Safe version |
|
||
|---|---|---|---|
| Sep 09, 2026 |
CVE-2026-76801
FireBox permits author-level code execution through PHP condition rules
FireBox through 3.1.10 stores unsanitized PHP condition-rule values through the firebox_meta REST endpoint. When the value function evaluates them, the regex blacklist in Executer::allowedToRun() fails to prevent dangerous function calls, allowing server-side code execution. On sites upgraded from a version before 3.1.10, Migrator::preserveCampaignRoleAccess() grants Authors edit_fireboxes and publish_fireboxes, making those Author accounts able to reach the vulnerable functionality.
|
3.1.11 |
CVE8.8
NVDPending
|
| Jun 18, 2026 |
CVE-2026-12120
FireBox Popups – Increase Sales and Grow Your Email List: Sensitive information exposure
FireBox Popups – Increase Sales and Grow Your Email List is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 3.1.7.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 09, 2025 |
CVE-2025-67545
FireBox: Cross-site scripting
FireBox is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|