The Popup Box – Easily Create WordPress Popups plugin is vulnerable to stored cross‑site scripting through its iframeBox shortcode in all versions up to 3.2.12. Insufficient input sanitization and output escaping allow an attacker with contributor‑level or higher WordPress access to inject arbitrary JavaScript that will run whenever a site visitor views any page containing the malicious shortcode. This can lead to session hijacking, data theft, or defacement of the site. The weakness is a classic stored XSS flaw.

All installations of the Popup Box – Easily Create WordPress Popups plugin on WordPress sites where the plugin version is 3.2.12 or earlier are affected. The flaw exists in any configuration where contributors can create or edit content that includes the iframeBox shortcode.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw only after authenticating as a contributor or higher user, which is the inferred attack vector. Once an attacker injects malicious scripts via the shortcode, the stored payload is delivered to all site visitors, providing broad impact across the site's audience.