Stored XSS in Popup Maker WordPress Plugin (CVE-2026-87915)

The Popup Maker - Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-87915, affecting all versions up to and including 1.24.0. The vulnerability exists due to inadequate input sanitization and output escaping of the 'values[Name]' parameter.

Attackers can exploit this flaw by submitting crafted payloads that bypass standard WordPress sanitization functions. Specifically, HTML entities within allowed attribute values are not correctly normalized. These malicious strings are subsequently processed by the jQuery(link.attr('href')) sink in the 'wp-admin/js/common.js' script when an administrator or privileged user interacts with a contextual help tab anchor within the WordPress dashboard. This leads to the execution of arbitrary JavaScript in the victim's browser session, potentially resulting in session hijacking, administrative action spoofing, or further site compromise.

Impact

The vulnerability poses a significant risk to WordPress site administrators. If exploited, an unauthenticated attacker can execute arbitrary scripts within the context of a privileged user's session. This could lead to full administrative account takeover, unauthorized modification of site content, or the installation of malicious backdoors on the affected WordPress instance. The attack is particularly concerning as it triggers via common administrative interface interactions, increasing the likelihood of successful exploitation against site owners.

Recommendation

Prioritize the immediate update of the Popup Maker plugin to the latest version. Monitor web server access logs for anomalous POST requests directed at plugin configuration endpoints that include unusual attribute values or encoded characters.