according to wpscan its been reported to owner since june and still not fixed
Plugin Support
Jawada
(@jawada)
Hi,
The cross site scripting issue has been fixed with our latest version V4.2.0, and we are working on other issues currently. Please bear with us.
Regards
According to the security scan report this was not fixed in V4.2. At this point we just deleted the plugin. We’ll find a different one that’s more well maintained.
Plugin Support
Jawada
(@jawada)
Hi
We are pleased to inform you that the security vulnerability you reported has been addressed and resolved in our latest update, version 4.2.2. I will now mark this thread as resolved. If you require further assistance or have any additional questions, please don’t hesitate to contact us through our support portal. Our team is always here to help!
https://help.popup-builder.com/en/
Sincerely,