The WP Popup Magic plugin is vulnerable to a stored cross‑site scripting flaw that can be triggered via the 'name' attribute of the [wppum_end] shortcode. Because input is not properly sanitized and output is not escaped, an attacker can inject arbitrary JavaScript that will run whenever a page containing the injected shortcode is viewed by any user. The vulnerability requires the attacker to have authenticated Contributor or higher privileges, but once injected it can affect all users who load the affected page.

Vendors: ThemeLocation; Product: WP Popup Magic. All releases up to and including version 1.0.0 are affected. Any WordPress installation that has this plugin installed and a contributor or higher‑privileged user could be impacted.

The CVSS score of 6.4 indicates a moderate severity vulnerability. The EPSS score is reported as < 1%, reflecting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires authenticated access with at least Contributor level, an exploitable path exists on sites with unrestricted contributor permissions, but lateral movement to other assets would typically require further compromise.