CVE-2026-100159 | ays-pro Popup Box Plugin up to 6.4.2 on WordPress User IP Address ays_autoembed code injection

SecurityVulns
Yanac

A vulnerability was found in ays-pro Popup Box Plugin up to 6.4.2 on WordPress. It has been classified as critical. Impacted is the function Ays_Pb_Public::ays_autoembed of the component User IP Address. Performing a manipulation of the argument Client-IP/X-Forwarded-For/Forwarded/X-Forwarded/Forwarded-For results in code injection.

This vulnerability is identified as CVE-2026-100159. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More