This vulnerability is an improper neutralization of input that allows stored cross‑site scripting (XSS) in the Erez Hadas‑Sonnenschein Smartarget Popup plugin. It permits attackers to inject and persist malicious JavaScript in the plugin’s storage, which executes whenever the popup is rendered to a browser. No additional exploitation consequences are specifically described in the CVE documentation.

The affected product is the WordPress Smartarget Popup plugin released by Erez Hadas‑Sonnenschein. Versions up to and including 1.5 are vulnerable.

The CVSS score of 5.9 classifies the vulnerability as medium‑to‑high severity, and the EPSS score of < 1 % indicates that it is unlikely to be exploited at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker can inject JavaScript into the plugin’s input fields because the data is stored without proper sanitization; when a visitor views the popup, the malicious script will run in their browser. Based on the description, it is inferred that the attacker must have access to the input mechanism and that other users will view the popup. This mitigates the risk to moderately low‑to‑medium, depending on the plugin’s exposure to visitors.