Executive brief
The Advanced Popups plugin for WordPress allows website administrators with author-level access or higher to inject malicious scripts through the 'Notification Button Link' field. An attacker with these privileges could embed hidden code that executes whenever visitors view affected pages, potentially stealing credentials, redirecting users to malicious sites, or defacing website content.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Advanced Popups WordPress plugin affecting versions up to 1.2.3. The vulnerability exists in the 'Notification Button Link' field due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or above can inject arbitrary web scripts that persist in the database and execute in the browsers of all users who visit affected pages. The vulnerability requires authentication and administrative privileges to exploit, but allows arbitrary JavaScript execution in the context of the WordPress site. A patch was released in version 1.2.4.
Affected products
- WordPress.org Advanced Popups up to and including 1.2.3
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 1.2.4