The Popup Maker plugin for WordPress contains a stored cross‑site scripting flaw in the title parameter of its popup editor. Because the value is not properly sanitized or escaped, an authenticated user with Contributor or higher permissions can inject malicious scripts that are later executed by any visitor who opens a page containing the vulnerable popup. This flaw is classified as CWE‑79 and provides attackers with direct code execution in the context of the visited site, potentially leading to session hijacking, defacement, or further attacks on other users.

WordPress sites that have the Popup Maker plugin developed by danieliser installed in any release up to and including version 1.20.6. The vulnerability requires a user account with at least Contributor access; any authenticated Contributor can trigger it.

The CVSS score of 6.4 reflects a moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Attackers would need to log in with appropriate permissions, edit a popup title to include malicious script code, and then save the change. Once saved, the script runs whenever any user loads a page that displays the popup, allowing the attacker to execute arbitrary code in the victim's browser context.