Improper neutralization of user input during web page generation in the Popup Maker plugin leads to a stored cross‑site scripting flaw. Malicious script code can be embedded into plugin data and later executed whenever the affected page is rendered, potentially giving an attacker the ability to steal visitor credentials, deface content, inject further malware, or hijack user sessions. The vulnerability persists until the stored data is removed or the plugin is updated.

The flaw is present in Daniel Iser’s Popup Maker WordPress plugin versions up through 1.20.2. Any WordPress site running a version this old or older of the plugin, or that has not yet applied the official update, is at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would probably need to inject the malicious input via the plugin’s administrative interface, which is only accessible to users with sufficient WordPress permissions, making the required access level high. Once the script is stored, it runs in the context of any site visitor, potentially exposing them to the consequences mentioned above.