WP Manifestindependent plugin directory
manifest / forms / green-popups

Green Popups WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

Popup builder for Wordpress.

★ 0stars
30release downloads
≈10active sites
v7.6.4latest · 22d ago

Install

Download halfdata-green-popups-7.6.4.zip From the v7.6.4 release on GitHub, Oct 3, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/halfdata/green-popups/releases/download/v7.6.4/halfdata-green-popups-7.6.4.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

Green Popups for WordPress

Internet is full of boring popups. So, it's a time to break this trend. That's why we created Green Popups. With this plugin you can realize your imagination and make your own unique multi-layers animated popups or use over 200 professionally designed ready made templates from our library. You can embed AJAX-ed subscription/contact form which works with a lot of CRM, marketing and newsletter systems. You can raise popup on page load, on exit intent, on scrolling down, on user's inactivity, on AdBlock detected or show it when users click something. Moreover you can use any popup as a part of post/page content or as sidebar widget. Make your website more attractive with Green Popups.

With our new Advanced Targeting system it's really easy to adjust how and where to display popups. It can be posts, pages, products and even any custom post types filtered by any available taxonomies, dates, user roles, etc. Pretty flexible. Isn't it?

Features

  • Unlimited number of popups. Create as many popup as you wish.
  • Multiple layers. Each popup can contain any number of elements (layers).
  • Drag-n-drop popup builder. Create popups with easy-to-use drag and drop Popup Builder. No coding knowledge is needed.
  • Over 20 popup elements. Plugin has everything that is needed to create unique popups. No limits to your imagination.
  • Advanced targeting system. Accurately adjust how and where to display popups. It can be posts, pages, products, custom post types filtered by any available taxonomies.
  • Popup and inline modes. Use any popups as regular popups or easily embed them into page content (insert relevant shortcodes or widgets).
  • OnClick popups. Show any popup when users click something.
  • OnLoad popups. Show any popup when page loaded.
  • OnScroll popup. Show any popup when user scroll down the page.
  • OnExit popup. Show any popup when user moves mouse pointer to the top of browser window assuming that he/she going to leave the page.
  • OnInactivity popup. Show any popup after certain period of user's inactivity.
  • OnAdBlockDetected popup. Show any popup if any AdBlock software detected.
  • Geolocation filter. Show OnLoad, OnScroll, etc. popups to visitors based on their geolocation. Green Popups has integration with Geolocation IP Detection plugin and ipstack.com.
  • ContentStart inline popup. Automatically add inline popup at the beginning of post/page/etc. content.
  • ContentEnd inline popup. Automatically add inline popup at the end of post/page/etc. content.
  • Link locker. Limit access to certain links until user submit the popup's form.
  • Confirmation system logic. Show confirmations based on user input and selection.
  • Double opt-in. Request users to confirm email addresses.
  • Email notifications. Send custom email notifications and user confirmation emails. Use conditional logic, if needed.
  • Extended e-mail address validation. Check MX records according to the host provided within the email address.
  • Integrations with email verification services. Green Popups works with Clearout, Email List Verify, Email List Validation, Kickbox, TheChecker, TrueMail.
  • Integrations with CRM and Newsletter systems. Automatically submit user input and selection to popular CRM, marketing and newsletter services. Plugin works with: Acelle Mail, ActiveCampaign, ActiveTrail, AgileCRM, Automizy, AvangEmail, AWeber, Beehiiv, BirdSend, Bitrix24, Campaign Monitor, CleverReach, Constant Contact, Conversio, ConvertKit, Drip, E-goi, EmailOctopus, Encharge, FluentCRM, FreshMail, GetResponse, Gist, Groundhogg, HubSpot, INBOX, Infomaniak Newsletter, Intercom, Interspire, Jetpack Subscriptions, Klaviyo, Mad Mimi, Mailautic, MailChimp, MailerLite, MailFit, Mailgun, Mailjet, Mailmodo, MailPoet, Mailrelay, Mailster, MailWizz, Mautic, MojSMS, Moosend, Mumara, Newsman, Omnisend, Ontraport, Pabbly Email Marketing, Pipedrive, Rapidmail, Salesflare, SalesAutoPilot, Sender, SendFox, SendGrid, SendinBlue, SendPulse, Sendy, SG Autorepondeur, SocketLabs (Email Marketing Center), The Newsletter Plugin, Tribulant Newsletters, VerticalResponse, Your Mailing List Provider, Zapier, Zoho CRM. Use conditional logic, if needed.
  • Integrations with payment providers. Request users to complete the payment through the following payment providers: Authorize.Net, Blockchain, Instamojo, InterKassa, Mollie, PayFast, PayPal, Paystack, PayUmoney, Perfect Money, Razorpay, Skrill, Stripe, WePay, Yandex.Money.
  • Integrations with SMS gateways. Send notifications by SMS through the following SMS providers: BulkGate, GatewayAPI, Nexmo, MojSMS, Twilio. Use conditional logic, if needed.
  • HTML-form integration. Automatically submit user input and selection to 3rd party HTML-forms given by your service provider.
  • Custom JavaScript Handlers. Execute your JavaScript-code when popup open, form submitted, etc.
  • 3rd party MySQL database/table. Insert form data into 3rd party MySQL database/table.
  • Math expressions. Perform powerful real-time Math expressions based on user input and selection.
  • Pre-populate fields. Do it with dynamic data from URL or by setting static default values.
  • User input editor. You can easily edit, empty or delete data submitted by user.
  • User input filtering. Use optional filters to strip unwanted submitted data.
  • Field validation. Validate user input using 14 built-in validators.
  • Conditional logic. Perform actions on popup fields and elements based on user input and selection.
  • Custom error messages. Show custom error bubble based on validation result.
  • Print data and save as PDF. Easily move forms between different installations.
  • Shortcodes supported (experimental). Add WP shortcodes into layer content.
  • Font Awesome supported. Use any Font Awesome icons.
  • 9 popup positions. Place popup on desired screen position.
  • Enable/disable overlay. Enable/disable overlay.
  • Custom layer duration/animation. Customize layer duration/animation with ease.
  • Spinner customization. Change spinner colors.
  • A/B Campaigns. create unlimited number of A/B campaigns, get statistics and choose the best popup for your purposes.
  • Popup stats. Stats of impressions, submissions, confirmations and payments for any popup for any period.
  • Field analytics. A set of submitted data can be represented in a convenient way, such as bar charts.
  • GDPR-ready. Add mandatory checkbox to any popup. Disable saving sensitive data into database. Integration with WordPress Personal Data tools.
  • Sensitive data saving. Decide which user data must be saved in database.
  • Google/Universal Analytics event tracker supported. track popup events.
  • Remote use. Easily embed any popup into 3rd party sites (just copy-paste couple JS/HTML-snippets).
  • Popups Library. Access to remote popups library with over 200 ready-made popups.
  • Export/import feature. Easily export popup settings from one website and import to another website.
  • CSV Export. Submitted data can be exported as CSV-file.
  • Interactive popups. Popups can interact with users by displaying the users input in real-time.
  • Opt-in locker (optional). Users must subscribe to close popup.
  • Multi-steps popups. Yes, you can do it now.
  • Remember subscribed visitors. Plugin set cookie on user machine to avoid repeated popups for already subscribed.
  • PageSpeed Insights optimized. Minimum resources loaded with pages - Google will love you.
  • Enable/disable modules. Enable/disable e-mail marketing providers, payment providers and SMS gateways modules.
  • WooCommerce compatible. Compatible with WooCommerce general and product pages.
  • Minified CSS and JS. Turn on/off using minified JS and CSS files.
  • 1000+ Google Fonts. Use any of 1000+ webfonts.
  • Automatic update. You do not need to do it manually anymore.
  • WPML support. Create separate popup for each language.
  • Multisite support. Green Popups works with WordPress multisite.
  • Easy to install. Install and activate the plugin as any other plugins.
  • Translation ready. Plugin might be translated to any language.
  • WordPress Best Practices. No any alerts from Plugin Check and WP_DEBUG.

Frontend Demo

Visit our website to see how it works.

Backend Demo

Try the following credentials to test Green Popups backend:

URL: https://greenpopups.com/wordpress-demo/wp-admin/
Login: demo
Password: demo

Installation

Green Popups is a WordPress plugin and it is installed as regular WordPress plugin:

  1. Go to WordPress dashboard and click left side menu "Plugins >> Add New".
  2. Click "Upload" link and upload zip-archive that contains the plugin.
  3. Activate uploaded plugin.
If you have any difficulties with uploading zip-archive, please do it manually using FTP:
  1. Use any FTP-client to connect your server.
  2. Unzip archive that contains the plugin.
  3. Upload unzipped folder to plugins directory: /wp-content/plugins/
  4. Go to WordPress dashboard, click left side menu "Plugins" and activate uploaded plugin.
Once installed and activated, plugin creates "Green Popups" menu section in left side menu. All further actions, related to plugin functionality, are done through this menu section.

Usage

Please read documentation or watch video tutorials.

Changelog

Please visit changelog and check out what we added/fixed in latest version of Green Popups.

Support us

Feel free to buy me a coffee. :-)

Disclaimer

This plugin is distributed "AS IS" and the author bears no responsibility for any damages or issues caused by its use.

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v7.6.4 latest
Oct 3, 2026 22d ago
halfdata-green-popups-7.6.4.zip
8
Sep 21, 2026 1mo ago
halfdata-green-popups-7.6.3.zip
2
Sep 16, 2026 1mo ago
halfdata-green-popups-7.6.2.zip
4
Aug 5, 2026 2mo ago
halfdata-green-popups-7.6.1.zip
10
Jul 29, 2026 2mo ago
halfdata-green-popups-7.6.0.zip
6

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

Green Popups 7.6.4 · audited by WP Registry

High-severity findings.

2 high 2 low
Audited release
7.6.4
Findings
4
Worst severity
high
Content hash
4df319c791d797889bce298f…

Findings

  • high Unauthenticated stored XSS in admin record details via choice-field values

    xss_stored

    front_submit (nopriv) stores raw submitted values for select/radio/checkbox/multiselect/imageselect/tile elements without checking that they are one of the configured options. In log_record_details_html(), values that do not match an option are appended to the output without escaping and returned as JSON html, which admin.js lepopup_record_details_open() injects with jQuery .html(data.html). Any unauthenticated visitor can therefore plant <img src=x onerror=...> markup that executes in an administrator's browser when the record is viewed, allowing actions such as creating admin users.

    green-popups.php:2998-3012,3036

    Recommendation

    esc_html() option labels/values and unmatched values before output; reject submitted values not present in the element's options in validate_form_data().

  • high PayUmoney webhook forgeable: hash check disabled, shared secret disclosed to visitors

    auth_bypass

    The PayUmoney IPN handler only checks that the LEPOPUP-UID header and udf1 equal $lepopup->installation_uid; the sha512 response-hash verification is commented out. front_submit() returns the PayUmoney request-data (including udf1 = installation_uid) to the unauthenticated submitter. A visitor can therefore submit a payment popup, read the uid from the response and POST a JSON body with status=Success and a sufficient amount to /?lepopup-payumoney-ipn-handler, marking the record PAID and firing payment-success notifications, integrations and the lepopup_successfully_paid action. The Razorpay webhook uses the same installation_uid as its HMAC key, so it is also forgeable once the uid is known.

    modules/payumoney.php:257,275-310,333-345

    Recommendation

    Re-enable the PayUmoney reverse-hash verification with the merchant salt (hash_equals), verify the payment server-side via the PayU API, and use a dedicated non-disclosed webhook secret rather than installation_uid (also for Razorpay).

  • low Upload extension denylist when allowed list is empty

    unsafe_input

    front_upload (nopriv) blocks only extensions beginning with 'php' when a file field has no allowed-extensions configured, so .phtml, .phar, .html, .svg etc. are accepted. Files are stored with random names in uploads/<dir>/uploads/<form_id>/ protected only by an Apache 2.2 'deny from all' .htaccess; on servers that ignore .htaccess the files are web-accessible (names are random, limiting exploitation).

    modules/core-ajax.php:2456-2476

    Recommendation

    Use a default allowlist and wp_check_filetype_and_ext(); store uploads outside the web root.

  • low PayPal/PayFast IPN postback without TLS verification; PayFast sandbox selectable by request

    insecure_config

    The PayPal and PayFast IPN handlers validate notifications by posting back with CURLOPT_SSL_VERIFYPEER/VERIFYHOST disabled, and PayFast picks the sandbox or live validation host based on the attacker-controlled custom_str1 request parameter.

    modules/payfast.php:221-233

    Recommendation

    Enable TLS verification and derive sandbox mode from the stored gateway configuration, not the request.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.