The Popup Box plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 6.4.1 to 6.4.2. The ays_popup_get_user_ip() function reads client‑controlled headers such as Client‑IP, X‑Forwarded‑For, Forwarded, X‑Forwarded, Fronted‑For, sanitizes them only with sanitize_text_field(), and substitutes the value into the %%user_ip_address%% token in popup content via raw str_replace. The resulting content is then passed to do_shortcode() unescaped during footer output. This allows an unauthenticated attacker to embed arbitrary shortcodes with custom attributes into the request headers, which are executed on the server, enabling the attacker to read sensitive data or trigger plugin‑provided actions. The weakness is identified as CWE‑94.

WordPress sites that have the ays‑pro Popup Box plugin installed in versions 6.4.1 through 6.4.2. The vulnerability is triggered when an administrator places the %%user_ip_address%% token in a popup’s Custom Content body.

The CVSS score of 4.8 indicates moderate damage potential. No EPSS value is available, and the issue is not listed in the CISA KEV catalog. The vulnerability can be exploited by any external user who can send HTTP requests to the site, as the attacker can set the Client‑IP/X‑Forwarded‑For headers to include malicious shortcode syntax. Exploitation does not require authentication or additional privileges. Given the code paths exposed, the risk is significant for sites that rely on shortcodes for sensitive operations but is lower than true arbitrary code execution. The attack vector is through crafted HTTP requests directed at the site’s front‑end.