Stored Cross-Site Scripting in Popup Maker Plugin for WordPress
CVE-2025-4205
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 3 June 2025
What is CVE-2025-4205?
The Popup Maker plugin for WordPress is susceptible to Stored Cross-Site Scripting due to a flaw in the way it handles the ‘popupID' parameter. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious scripts. The injected scripts can execute when users visit the infected pages, posing a significant risk to user data and site integrity. It is crucial to ensure that input sanitization and output escaping measures are properly implemented to mitigate this vulnerability.
Affected Version(s)
Popup Maker – Boost Sales, Con, Optins, Subscribers with the Ultimate WP Popups Builder * <= 1.20.4