Malware Campaign Exploits Popup Builder WordPress Plugin to Infect 3,900+ Sites

A malware campaign is actively exploiting a high-severity stored XSS/privilege escalation vulnerability in the Popup Builder WordPress plugin (CVE-2023-6000) to inject malicious JavaScript that redirects visitors to phishing and scam pages and can lead to creation of rogue admin users and arbitrary plugin installation; Sucuri reports over ~3,900 infected sites in three weeks. The report also highlights recently patched high-severity flaws in other WordPress components (Ultimate Member CVE-2024-2123 and Avada CVE-2024-1468) and urges plugin/theme updates and site scans.