CVE-2026-100159Published
Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-100159 · Microsoft / collected KEV context
cve-program · CVE-2026-100159
- https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cve
- https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389
- https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560
- https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299
- https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79
- https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69
- https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.