The vulnerability resides in the WDES Responsive Popup WordPress plugin, where the 'wdes-popup-title' shortcode does not properly sanitize or escape user‑supplied attributes. Because of this, code injected into the title attribute can be stored in the database and later rendered on any page that displays the popup, enabling arbitrary script execution in the context of the site’s users. This is a classic input validation weakness classified as CWE‑79, and the impact is the potential compromise of confidentiality, integrity, and availability of affected users’ browsers.

All installations of the WDES Responsive Popup plugin version 1.3.6 and earlier. The plugin is distributed by the master‑buldog vendor for WordPress. Sites that use the plugin with contributor‑level or higher privileges are vulnerable.

With a CVSS base score of 6.4 the vulnerability is moderately severe. The EPSS score is reported as < 1%, indicating a low‑to‑moderate probability of exploitation, and it is not listed in the CISA KEV catalog. The attack can be carried out by any authenticated user with contributor or higher access, who can edit the shortcode’s title attribute and insert malicious code. Once injected, the script executes for any visitor who views a page that includes the popup. The scope is limited to the site’s user base, but the impact on each user is significant.