CVE-2026-87915: Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via values[Name] Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpkses sanitization applied on output is insufficient in this context because HTML entities within allowed attribute values survive normalization intact and are later evaluated by the jQuery(link.attr('href')) sink in wp-admin/js/common.js when a contextual help tab anchor is clicked.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.24.0 - Compensating control
Apply input sanitization/output escaping for any user-controlled values used in the contextual help tab anchor href handling in wp-admin/js/common.js (jQuery(link.attr('href')) sink) to prevent stored XSS via values[Name].
Event History
Frequently Asked Questions
Does exploitation require an attacker to have a WordPress account or any prior privileges?
No. The issue can be exploited by an unauthenticated attacker and has low attack complexity, with no user interaction required to inject the malicious content.
When does injected script execute, and which users are most directly exposed?
The stored payload executes when a user accesses a page containing the injected content. The described execution path specifically involves a contextual help tab anchor being clicked, which uses a jQuery href-processing sink in WordPress admin code.