All packages
Popup Maker vulnerabilities
3 known CVE vulnerabilities in Popup Maker, translated and rated.
- CVE-2026-15797Medium
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to and including 1.24.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject scripts using HTML entity-encoded payloads.
- CVE-2026-28177High
Unauthenticated Cross Site Scripting (XSS) in Popup Maker versions up to and including 1.23.0.
- CVE-2026-8848High
The Popup Maker plugin for WordPress up to version 1.22.0 contains an authorization bypass vulnerability. It allows authenticated attackers with editor-level access or higher to install and activate arbitrary plugins from an external URL, leading to remote code execution.