Skip to content
PluginCanary

Popup Builder

Popup Builder - Create highly converting, mobile friendly marketing popups.
by popupbuilder · 200,000+ active installs · Checked 3 Nov 2026
Watch1 Warning

Watch: rating dropping. Last 90 days: 3.4 (5 reviews). Lifetime: 4.7.

78/ 100 Canary Score
Sub-scores for Popup Builder
Ownership100
Maintenance100
Security70
Support60
Reputation45

How the score works

Quick answers

Is Popup Builder still maintained?
Yes. Last release 19 Oct 2026, 12 releases in the last 24 months. 19 Oct 2026 · wordpress.org
Who owns Popup Builder, and has it changed hands?
No change recorded. Main committer minhgsvn since Jul 2023. 3 Nov 2026 · SVN log
Was Popup Builder removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Popup Builder safe?
25 known vulnerabilities, all fixed (latest in 4.4.6). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Popup Builder update safe to install?
No ownership change before 4.4.6. No one-star spike after it. 19 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • WarningREP-1Rating dropping. Last 90 days: 3.4 (5 reviews). Lifetime: 4.7. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
Sygnoos30 May 2015 to 19 Dec 2022, 600 commits
popupbuilder30 Mar 2023 to 30 Mar 2023, 4 commits
minhgsvn11 Jul 2023 to 19 Oct 2026, 50 commits

3 committers recorded. No ownership change since 2015.

Maintenance

Last release
16 days ago
Releases, 24 months
12
Tested up to
7.0 vs 7.1
Requires PHP
5.3.3 supported 8.2+
Releases per quarter
Releases per quarter for Popup Builder
Q1 20241
Q2 20242
Q3 20242
Q4 20242
Q1 20251
Q2 20252
Q3 20251
Q4 20252
Q1 20261
Q2 20261
Q3 20261
Q4 20261

Last release 19 Oct 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Reputation

Last 90 days: 3.4 (5 reviews). Lifetime: 4.7.

Average rating per quarter for Popup Builder
Q3 20253.7
Q4 20255.0
Q1 20265.0
Q2 20264.5
Q3 20263.4
Q4 20263.0

Average rating fell from 3.7 to 3.0 between Q3 2025 and Q4 2026.

Rating distribution
5 star2006
4 star59
3 star20
2 star18
1 star112
Latest low reviews

Security record

5 vulnerabilities in 24 months (25 on record), all patched (latest fixed in 4.4.6).

Show 25 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters9.1<= 4.4.54.4.6Patched before disclosure
23 Oct 2026Popup Builder – Create highly converting, mobile friendly marketing popups. < 4.4.6 - Missing Authorization5.3< 4.4.64.4.6Patched before disclosure
18 Feb 2026Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens5.3<= 4.4.24.4.3Patched before disclosure
12 Dec 2025Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.4.14.4.2Patched before disclosure
21 Nov 2024Popup Builder <= 4.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 4.3.44.3.5Patched before disclosure
28 Aug 2024Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File5.3<= 4.3.64.3.7202
14 Jun 2024Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions7.4<= 4.3.04.3.2Patched before disclosure
14 Jun 2024Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure8.1<= 4.3.14.3.2Patched before disclosure
31 May 2024Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS6.4<= 4.2.74.3.0Patched before disclosure
25 Mar 2024Popup Builder <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 4.2.64.2.7Patched before disclosure
17 Jan 2024Popup Builder <= 4.2.5 - Authenticated (Admin+) Server-Side Request Forgery5.5<= 4.2.54.2.6Patched before disclosure
11 Dec 2023Popup Builder <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting6.1< 4.2.34.2.3Patched before disclosure
28 Aug 2023Popup Builder <= 4.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 4.2.14.2.275
30 Jun 2022Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.1.11 - Cross-Site Request Forgery to Settings Update8.8<= 4.1.114.1.12Patched before disclosure
20 Jun 2022Popup Builder <= 4.1.10 - Authenticated (Admin+) Cross-Site Scripting5.5<= 4.1.104.1.11Patched before disclosure
17 Jun 2022Popup Builder <= 4.1.0 - Cross-Site Request Forgery4.3<= 4.1.04.1.11Patched before disclosure
7 Mar 2022Popup Builder <= 4.1.0 - SQL Injection9.8< 4.1.14.1.1Patched before disclosure
24 Jan 2022Popup Builder <= 4.0.6 - Local File Inclusion and PHAR Deserialization8.8< 4.0.74.0.7Patched before disclosure
24 Jan 2022Popup Builder <= 4.0.6 - Authenticated SQL Injection via order & orderby Parameters7.2< 4.0.74.0.7Patched before disclosure
2 Feb 2021Popup Builder <= 3.73 - Reflected Cross-Site Scripting6.1<= 3.733.74Patched before disclosure
28 Jan 2021Popup Builder <= 3.72 Missing Authorization on AJAX actions6.3<= 3.713.72Patched before disclosure
12 Mar 2020Popup Builder <= 3.63 - Unauthenticated Stored Cross-Site Scripting8.3<= 3.633.64.1Patched before disclosure
12 Mar 2020Popup Builder <= 3.63 - Authenticated Settings Modification, Configuration Disclosure, and User Data Export6.3<= 3.633.64.1Patched before disclosure
16 Feb 2020Popup Builder 2.2.8 - 2.6.7.6 - PHP Object Injection9.82.2.8 to 2.6.7.63.0n/a
6 Aug 2019Popup Builder <= 3.44 - SQL Injection9.8<= 3.443.45Patched before disclosure

Changelog mentions of security fixes: 4.4.6 (security, XSS, escaping, sanitize).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

60% of 5 support threads resolved in the last 2 months.

Momentum

200,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Popup Builder
4 May 20262,176
11 May 20264,746
18 May 20264,255
25 May 202672,021
1 Jun 202617,085
8 Jun 202611,134
15 Jun 20268,910
22 Jun 20267,641
29 Jun 20267,000
6 Jul 202613,141
13 Jul 202660,471
20 Jul 202624,786
27 Jul 202613,595
3 Aug 202617,954
10 Aug 20267,698
17 Aug 20267,104
24 Aug 20267,314
31 Aug 20266,630
7 Sep 20265,440
14 Sep 20265,442
21 Sep 20265,459
28 Sep 20265,232
5 Oct 20265,507
12 Oct 20264,840
19 Oct 202678,532
26 Oct 202625,698
2 Nov 20262,641

Weekly downloads over the last 4 weeks are 74% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

PoptinScore 96 · 20,000+Pop-upScore 93 · 10,000+Popup Builder & Popup Maker forScore 92 · 1,000,000+BoxzillaScore 92 · 20,000+Popups for DiviScore 91 · 100,000+

Facts

Version4.4.6
Authorpopupbuilder
Added30 May 2015
Last updated19 Oct 2026
Active installs200,000+
Requires WordPress4.2
Tested up to7.0.8
Requires PHP5.3.3
CategoryMarketing & Advertising > Pop-ups & Lead Generation
Tagspopup, pop up, popup maker, popup builder, wordpress popup

Questions

Is Popup Builder still maintained?

Yes. Last release 19 Oct 2026, 12 releases in the last 24 months.

Who owns Popup Builder, and has it changed hands?

No change recorded. Main committer minhgsvn since Jul 2023.

Was Popup Builder removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Popup Builder safe?

25 known vulnerabilities, all fixed (latest in 4.4.6). Not on the exploited list.

Is the latest Popup Builder update safe to install?

No ownership change before 4.4.6. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue