Description

Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:16:53.527Z",
  "pubdate": "2026-08-06T15:16:53.527Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the Popup Maker product affecting versions <= 1.23.0.\nThe vulnerability allows remote, unauthenticated threat actors to inject and execute arbitrary JavaScript or HTML code within the context of a victim's browser session.\nSuccessful exploitation of this flaw can lead to severe security implications, including session hijacking, credential theft, sensitive data exposure, and unauthorized actions performed on behalf of authenticated users interacting with the vulnerable WordPress site.\nThe attack vector involves tricking a user into navigating to a specially crafted URL containing malicious script payloads, which are subsequently rendered improperly by the vulnerable component without requiring prior authentication or elevated privileges.\nThe risk level is high due to the unauthenticated nature of the attack vector, potentially exposing any visitor or administrator interacting with affected instances to client-side compromise.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and inadequate output encoding within the Popup Maker product <= 1.23.0.\nUser-supplied input parameters processed by the application are reflected back to the user or stored without proper neutralization of executable markup, enabling Cross-Site Scripting.\nThe vulnerable component resides within the handling mechanisms of Popup Maker, where unauthenticated HTTP requests can introduce malicious payloads into the DOM.\nAuthentication requirements are entirely absent, permitting any remote attacker over the network to initiate exploitation without possessing valid user credentials or elevated privileges.\nNetwork exposure is fully public, as the attack is executed via standard web protocols (HTTP/HTTPS) against the target web application.\nThe exploitation method involves an attacker crafting a malicious URL incorporating an arbitrary JavaScript payload designed to execute within the victim's browser context upon rendering.\nThe attack flow proceeds as follows: First, the attacker constructs a crafted URL targeting the vulnerable endpoint in Popup Maker. Second, the attacker induces a victim (such as a standard visitor or an administrative user) to click the malicious link or load the resource via social engineering or reflected mechanisms. Third, the application processes the input parameters and embeds the unescaped payload into the HTTP response. Fourth, the victim's browser parses the response, executing the injected script within the security context of the origin site.\nPayload behavior includes accessing document cookies, querying the DOM, manipulating page content, or performing background requests utilizing the victim's session privileges.\nPost-exploitation impact encompasses complete session compromise, unauthorized administrative actions if an authenticated user is targeted, defacement, and potential redirection to malicious external sites."
}