CVE-2026-15797: Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to create a post with an HTML entity-encoded payload in the title, which bypasses sanitizetextfield on save and is later decoded and executed by the browser when rendered by the Select2 component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPressto a version that resolves this vulnerability.Fixed in 1.24.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to create a post whose title contains an HTML entity-encoded payload.
When does the injected script execute?
The payload is stored in the post title and executes when a user accesses an injected page where the title is rendered by the Select2 component. The attacker does not need further interaction after creating the malicious post.
Which versions are affected?
All Popup Maker versions up to and including 1.24.0 are affected. The provided information does not identify a fixed version.
How can administrators look for possible exploitation?
Review post titles created by Contributor-level or other non-administrative accounts for unexpected HTML entity-encoded content or suspicious script-like payloads. Pay particular attention to recently created posts and titles that appear harmless until HTML entities are decoded.