CVE-2026-85004
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Popup Maker WordPress plugin through version 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce. This allows authenticated users with minimal privileges such as Subscribers to overwrite a site-wide option (the linked service account and API configuration) that should only be modifiable by administrators.
Risk Assessment
An attacker with low privileges can take over the connection to an external service, potentially leading to unauthorized configuration changes and data integrity issues.
Recommendation
Update the Popup Maker plugin to the latest patched version. Additionally, restrict user privileges and regularly audit roles.
Other vulnerabilities in Popup Maker
See all- CVE-2026-15797Medium
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to and including 1.24.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject scripts using HTML entity-encoded payloads.
- CVE-2026-28177High
The Popup Maker plugin by Code Atlantic LLC contains an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that allows DOM-Based XSS. The issue affects versions up to and including 1.23.0.
- CVE-2026-8848High
The Popup Maker plugin for WordPress up to version 1.22.0 contains an authorization bypass vulnerability. It allows authenticated attackers with editor-level access or higher to install and activate arbitrary plugins from an external URL, leading to remote code execution.
- CVE-2025-9490Medium
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to and including 1.20.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS