The ConvertForce Popup Builder plugin for WordPress contains a Stored Cross‑Site Scripting flaw in the entrance_animation attribute of its Gutenberg block. Because user input is neither validated nor escaped, an attacker who is logged in with Author or higher privileges can inject malicious scripts that run when any visitor loads a page containing the block. This flaw is listed as CWE‑79 and enables the attacker to compromise the confidentiality, integrity, or availability of the user’s browser session and can result in credential theft, defacement, or further compromise of the site.

WordPress sites that have installed the ConvertForce Popup Builder plugin in any version up to and including 0.0.7 are affected. Version numbers are specified by the plugin’s developers as 0.0.0 through 0.0.7; no later versions of the plugin are known to contain this vulnerability.

The vulnerability scores a CVSS of 6.4, indicating a medium severity. The EPSS score is below 1 %, suggesting a low likelihood that attackers are actively exploiting the flaw. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as an Author or higher and to embed malicious content within the block, which will then be rendered and executed by unsuspecting visitors. Because the attack vector is restricted to authenticated users performing content editing, the risk is limited to sites with many active authors, but any successful exploitation could affect all site visitors.