CVE-2025-14895mediumCWE-862

CVE-2025-14895: medium-severity vulnerability in roxnor Popup builder with Gamification…

PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion

Published · Updated

Follow this CVE+ Monitor Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.3%
The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
roxnor · Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
Related CVEs — roxnor Popup builder with Gamification…

In the same product, most dangerous first.

CVE-2025-13192HIGHPopup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API EndpointsEPSS 0.4%CVE-2025-10862HIGHPopup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'EPSS 0.4%CVE-2025-10861HIGHPopup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request ForgeryEPSS 0.4%CVE-2025-14441MEDIUMPopupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data DeletionEPSS 0.2%