The Nks Email Subscription Popup plugin includes an improper neutralization of user input during web page generation, which allows a stored cross‑site scripting (XSS) flaw. An attacker can embed malicious scripts into the plugin’s configuration or content that are later rendered by the website, potentially enabling session hijacking, cookie theft, or malicious content injection on the site.

This vulnerability affects all versions of the Email Subscription Popup plugin up to and including 1.2.26. Site owners who have installed any of these versions are at risk. No specific version numbers beyond the upper bound are mentioned.

The CVSS score of 5.9 indicates a medium severity flaw. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the nature of stored XSS, the attack vector is likely through the plugin’s subscription form or its administrative configuration interface, where an attacker can submit or modify content that is persisted and later displayed to site visitors.