The Popup Maker plugin for WordPress contains a stored cross‑site scripting flaw that can be triggered through the popupID parameter. Authenticated users with Contributor privileges or higher can inject arbitrary JavaScript into the plugin’s stored content, which will execute whenever any visitor loads the affected page. This enables attackers to steal session cookies, deface content, or execute further malicious actions within the victim’s browser.

The vulnerability affects the Popup Maker WordPress plugin by danieliser, version 1.20.4 and all earlier releases. It has been identified up to and including 1.20.4.

The CVSS score of 6.4 indicates a medium severity flaw. The EPSS score of fewer than 1% suggests that exploitation is unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must hold Contributor-level access or higher to inject code, and the exploitation path requires interaction with the plugin’s admin interface. While the attack vector is authenticated, the threat potential remains significant due to the ability to execute code in the browsers of all users who view the stored content.