Executive brief
WP Magnific Popup, a WordPress plugin used for displaying images in popup windows, contains a security flaw in how it handles link URLs. An attacker with Author-level permissions can insert malicious code into a link that executes when other users, including administrators, view the page. This could lead to unauthorized actions being performed in the context of the victim's session, potentially compromising the website or its data.
Technical details
The WP Magnific Popup plugin for WordPress (versions up to and including 1.0) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'href' attribute of links using the 'mpopup' class. The vulnerability exists because the plugin fails to properly escape or sanitize user-provided URLs before injecting them into the DOM when displaying image load error messages. An authenticated attacker with Author-level privileges or higher can craft a malicious link containing a JavaScript payload. When a victim clicks the link or triggers an image load error, the payload executes in their browser context. As of the advisory date, there is no known patch available.
Affected products
- Unknown WP Magnific Popup <= 1.0
Timeline
- 2026-05-27: disclosed: Initial public disclosure by WPScan
- 2026-06-17: advisory: NVD publication date