Stored Cross-Site Scripting Vulnerability in Popup Maker Plugin for WordPress
CVE-2026-87915

7.2HIGH

Key Information:

Vendor

WordPress
Status
Popup Maker – Boost Sales, Conversions, Optins, Subscribers With The Ultimate WP Popup Builder
Vendor
CVE Published:
18 September 2026

What is CVE-2026-87915?

The Popup Maker plugin for WordPress is susceptible to stored cross-site scripting due to inadequate input sanitization and output escaping in the values[Name] parameter. Attackers can exploit this vulnerability to inject arbitrary web scripts that get executed whenever users access the compromised page. The existing wp_kses sanitization fails to effectively normalize certain HTML entities, leading to their evaluation in the jQuery(link.attr('href')) context within the WordPress admin area. This flaw highlights the critical need for improved sanitization controls to safeguard against malicious exploits.

Affected Version(s)

Popup Maker – Boost Sales, Con, Optins, Subscribers with the Ultimate WP Popup Builder 0 <= 1.24.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/popup-maker/ta...
https://plugins.trac.wordpress.org/browser/popup-maker/ta...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoya Takahashi (nakko)
.