The vulnerability resides in the Themify Popup WordPress plugin, where the 'popup_width_unit' parameter is not properly sanitized or escaped before being stored. When an authenticated user with author-level or higher access includes malicious script code in that field, the content is saved in the database and subsequently rendered in the popup. This allows an attacker to inject arbitrary JavaScript that will execute in the browsers of any user who views the affected popup page, potentially leading to defacement, credential theft, or further web-based attacks.

All installations of the Themify Popup plugin up to and including version 1.4.7 are affected. The plugin is distributed by themifyme and can be found in the WordPress plugin repository.

The CVSS score of 6.4 indicates a moderate severity. An attacker must first obtain author-level or higher WordPress credentials to exploit the issue, but no additional network or privilege escalation is required beyond this. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Nonetheless, the stored XSS vector can compromise the user experience and potentially user data on the site.