Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to create a post with an HTML entity-encoded payload in the title, which bypasses sanitize_text_field on save and is later decoded and executed by the browser when rendered by the Select2 component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| danieliser | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | up to 1.24.0 | — | No fix listed | CNA |
- Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder Vendordanieliser Affected up to 1.24.0 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:code-atlantic:popup_maker:*:*:*:*:*:*:*:* | — | — | danieliser |
- cpe:2.3:a:code-atlantic:popup_maker:*:*:*:*:*:*:*:* Versions — — ·danieliser
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-15797
- 2026-10-03 Alias added: GHSA-m455-q9mx-cr49
References
Other 11
- https://www.wordfence.com/threat-intel/vulnerabilities/id/973b23c6-4edd-4f89-b5cf-68e83cfdb8ac?source=cve
- https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.23.0/classes/Admin/Ajax.php#L163
- https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.23.0/dist/assets/admin-general.js#L1
- https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.23.0/classes/Admin/Ajax.php#L152
- https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.23.0/classes/Helpers.php#L192
- https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/Admin/Ajax.php#L163
- https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/dist/assets/admin-general.js#L1
- https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/Admin/Ajax.php#L152
- https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.22.0/classes/Helpers.php#L192
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3690634%40popup-maker%2Ftags%2F1.25.0&old=3648112%40popup-maker%2Ftags%2F1.24.0
- https://plugins.trac.wordpress.org/changeset/3690634/popup-maker/trunk/classes/Admin/Ajax.php
More danieliser vulnerabilities
- TI-2022-04122 Content Control < 1.1.10 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2022-04012 Popup Maker < 1.16.9 - Contributor+ Stored XSS via Subscription Form CVSS 3.1MEDIUM 5.4
- TI-2022-03995 Popup Maker < 1.16.9 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 5.4
- TI-2022-03392 Popup Maker < 1.16.11 - Contributor+ Stored Cross Site Scripting CVSS 3.1MEDIUM 5.5
- TI-2024-05169 Popup Maker < 1.19.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2022-00999 Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
Sources
- CVE-2026-15797 · CVE Program
- CVE-2026-15797 · NVD
- FIRST EPSS
- GHSA-m455-q9mx-cr49 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences