Executive brief
Popup Maker is a WordPress plugin for building popups to boost sales and collect subscriber information. The plugin is vulnerable to stored cross-site scripting (XSS), allowing unauthenticated attackers to inject malicious scripts into popups that execute whenever any user views an affected page, potentially compromising visitor data or redirecting users to phishing sites.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the values[Name] parameter, affecting all versions up to and including 1.24.0. The root cause is insufficient input sanitization and output escaping; the wp_kses sanitization applied on output fails to neutralize HTML entities within allowed attribute values. An unauthenticated attacker can inject arbitrary JavaScript that is stored in the database and later executed when users interact with contextual help tabs, specifically when jQuery(link.attr('href')) is evaluated in wp-admin/js/common.js. The attack requires no authentication, as the vulnerable parameter accepts unauthenticated input, and impacts all visitors to affected pages.
Affected products
- WordPress Popup Maker up to and including 1.24.0
Timeline
- 2026-09-18: disclosed