The JetPopup plugin for WordPress is vulnerable to an insertion of sensitive information into data that is sent to users or other systems. This flaw allows the plugin to embed hidden or confidential data in its outputs, leading to exposure of sensitive information. It is classified as CWE‑201, indicating an information exposure due to an unauthorized data path.

Crocoblock’s JetPopup plugin, all versions released through 2.0.15 inclusive, are affected.

The CVSS score of 6.5 places this issue in the medium severity range. An EPSS score of below 1% indicates that active exploitation is highly unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Exposure occurs when the plugin processes content that contains sensitive data; an attacker would need to trigger the plugin’s data handling routines. Based on the description, the likely attack vector is the submission of crafted user content that prompts the plugin to embed sensitive information, or through accessing the plugin’s output channels where the data is transmitted. The vulnerability does not appear to require privileged access beyond normal WordPress user permissions, potentially allowing exploitation by users who can submit content or view plugin output.