CVE-2026-15797
MediumCVSS 6.4Summary
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to and including 1.24.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject scripts using HTML entity-encoded payloads.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the plugin to the latest version and restrict user permissions.
Other vulnerabilities in Popup Maker
See all- CVE-2026-28177High
Unauthenticated Cross Site Scripting (XSS) in Popup Maker versions up to and including 1.23.0.
- CVE-2026-8848High
The Popup Maker plugin for WordPress up to version 1.22.0 contains an authorization bypass vulnerability. It allows authenticated attackers with editor-level access or higher to install and activate arbitrary plugins from an external URL, leading to remote code execution.
Original NVD description (English source)
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to create a post with an HTML entity-encoded payload in the title, which bypasses sanitize_text_field on save and is later decoded and executed by the browser when rendered by the Select2 component.