The WP Responsive Popup + Optin plugin does not protect its admin settings form with WordPress nonce checks, allowing an attacker to forge a request that changes the plugin’s configuration. The forged request can set the wpo_image_url parameter to an arbitrary value, which is then stored and output directly in the WordPress admin interface. This flaw is a classic example of CWE‑352, a Cross‑Site Request Forgery weakness that enables stored cross‑site scripting. A malicious actor could inject JavaScript that executes whenever any administrator reviews the plugin’s settings page, potentially compromising administrator sessions or injecting further malicious content.

Sites running any version of WP Responsive Popup + Optin up to and including 1.4 are affected. Administrators who have active accounts on such installations are at risk; upgrades or removal of the plugin beyond version 1.4 eliminate the vulnerability.

The CVSS score of 6.1 classifies this flaw as moderate severity, yet the lack of an EPSS score means exploitation probability remains unknown, and it is not listed in the CISA KEV catalog. To exploit, an attacker must convince an administrator to visit a crafted link or submit a form that triggers the forged request— a realistic social‑engineering vector. Once the malicious URL is stored, the injected script runs each time the admin page loads, allowing cookie theft, phishing, or further site compromise.