The plugin fails to properly escape script tags in user‑generated popup content, enabling a reflected XSS attack. An attacker could deliver malicious JavaScript that executes in the context of any site visitor who views the popup. This could result in session hijacking, credential theft, defacement, or redirection to phishing sites. The weakness is a classic CWE‑79 flaw.

The vulnerability is limited to the WordPress plugin Rock Solid Responsive Modal Builder for High Conversion – Easy Popups, affecting all releases up to and including version 1.5.0. No specific operating system or underlying platform restrictions are mentioned; it applies to any WordPress deployment that utilizes the plugin.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score indicates a very low probability of exploitation at the time of this analysis, and it is not listed in the CISA KEV catalog. Because the flaw is a reflected XSS, an attacker only needs to supply malicious input that ends up rendered in the popup, which can be achieved through the plugin’s content editor or through crafted URLs. No special privileges or user interaction beyond viewing the affected page are required.