{"metadata": {"vulnerability": "CVE-2026-100159", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-25T12:19:23.903Z", "date_only": false, "value": "2026-09-25T12:19:23.903Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-100159", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-25T12:34:28Z", "date_only": false, "value": "2026-09-25T12:34:28.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-100159", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T13:57:16Z", "date_only": false, "value": "2026-10-15T13:57:16.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-100159", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T02:26:09.256Z", "date_only": false, "value": "2026-10-16T02:26:09.256Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100159", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T02:26:09.256Z", "date_only": false, "value": "2026-10-16T02:26:09.256Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-100159", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T02:45:18.375Z", "date_only": false, "value": "2026-10-16T02:45:18.375411Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448292287218145", "record": "CVE-2026-100159", "field": "creation_timestamp", "uuid": "5b6de53f-c3d5-414e-bafb-c6fbd468e00c", "content": "CVE-2026-100159 Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with sanitize_text_field() (which does not strip the bracket, quote, space, or '=' characters used by shortcode syntax), substituting the value into a popup body wherever the %%user_ip_address%% token appears (a raw str_replace with no escaping in Ays_Pb_Data::replace_message_variables()), and then passing the resulting body to do_shortcode() in Ays_Pb_Public::ays_autoembed() at output on the wp_footer hook. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes with attacker-supplied attributes on the server whenever an administrator has added the %%user_ip_address%% token to a popup's Custom Content body, which can be leveraged to read arbitrary data or perform other actions exposed by shortcodes installed on the site.\nhttps://www.cve.org/CVERecord?id=CVE-2026-100159https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=cvehttps://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/class-ays-pb-public.php#L3389https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4560https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L4299https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/includes/class-ays-pb-data.php#L79https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.2/public/partials/ays-pb-public-templates.php#L69https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/6.4.3/public/class-ays-pb-public.php#wordpress #ays-pro #PopupBox\u2013CreateCountdown,Coupon,Video,ContactFormPopups#CVE_2026_100159#bot", "url": "https://infosec.exchange/users/cve/statuses/117448292287218145"}, {"timestamp": "2026-10-16T03:17:58Z", "date_only": false, "value": "2026-10-16T03:17:58Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5JV4-J9F2-3247", "record": "GHSA-5JV4-J9F2-3247", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T03:17:58Z", "date_only": false, "value": "2026-10-16T03:17:58.000", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100159", "record": "FKIE_CVE-2026-100159", "field": "published"}, {"timestamp": "2026-10-16T03:30:24Z", "date_only": false, "value": "2026-10-16T03:30:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5JV4-J9F2-3247", "record": "GHSA-5JV4-J9F2-3247", "field": "published"}, {"timestamp": "2026-10-16T03:30:24Z", "date_only": false, "value": "2026-10-16T03:30:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5JV4-J9F2-3247", "record": "GHSA-5JV4-J9F2-3247", "field": "modified"}, {"timestamp": "2026-10-16T14:50:08.374Z", "date_only": false, "value": "2026-10-16T14:50:08.374687Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-100159", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:50:08.374Z", "date_only": false, "value": "2026-10-16T14:50:08.374687Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100159", "record": "FKIE_CVE-2026-100159", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:09:41.509Z", "date_only": false, "value": "2026-10-16T15:09:41.509Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-100159", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:09:41.509Z", "date_only": false, "value": "2026-10-16T15:09:41.509Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-100159", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:16:58.060Z", "date_only": false, "value": "2026-10-16T15:16:58.060", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100159", "record": "FKIE_CVE-2026-100159", "field": "lastModified"}]}