Cross-site Scripting Vulnerability in Nks Email Subscription Popup Plugin

CVE-2025-49912

What is CVE-2025-49912?

The Nks Email Subscription Popup plugin for WordPress is susceptible to a Cross-site Scripting vulnerability that allows an attacker to inject malicious scripts into web pages. This flaw enables the potential storage of harmful scripts, which can be executed in the context of a user’s browser when they interact with the compromised plugin. The vulnerability impacts versions up to and including 1.2.26, highlighting the need for users to update and secure their installations to prevent exploitation.

References