The LotekMedia Popup Form plugin for WordPress allows logged‑in administrators to modify plugin settings. A flaw in the input handling makes it possible for these privileged users to inject arbitrary JavaScript into the stored settings. When a user visits a page that displays the popup, the malicious script executes in the visitor’s browser, enabling hijacking of sessions, theft of cookies, or defacement of the site. This is a classic stored cross‑site scripting vulnerability (CWE‑79).

Affected systems are WordPress sites that have the LotekMedia Popup Form plugin installed, versions 1.0.6 and earlier. The plugin may appear in any WordPress installation that relies on it to display pop‑ups. No specific operating system or PHP version constraints are listed.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. Because the flaw requires administrator authentication, an attacker must first compromise or be granted admin access to the site. Once authenticated, injecting script into the plugin settings is trivial. Though not listed in CISA’s KEV catalog, the vulnerability remains a risk for sites that have not applied an official patch or do not restrict administrator access appropriately.