CVE-2025-9490
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to and including 1.20.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
Risk Assessment
Attackers can inject malicious scripts that execute in the user's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Update the Popup Maker plugin to a version newer than 1.20.6 that includes the fix.
Other vulnerabilities in Popup Maker
See all- CVE-2026-85004Medium
The Popup Maker WordPress plugin through version 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce. This allows authenticated users with minimal privileges such as Subscribers to overwrite a site-wide option (the linked service account and API configuration) that should only be modifiable by administrators.
- CVE-2026-15797Medium
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to and including 1.24.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject scripts using HTML entity-encoded payloads.
- CVE-2026-28177High
The Popup Maker plugin by Code Atlantic LLC contains an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that allows DOM-Based XSS. The issue affects versions up to and including 1.23.0.
- CVE-2026-8848High
The Popup Maker plugin for WordPress up to version 1.22.0 contains an authorization bypass vulnerability. It allows authenticated attackers with editor-level access or higher to install and activate arbitrary plugins from an external URL, leading to remote code execution.
Original NVD description (English source)
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS