CVE-2022-3690 in Popup Maker Plugin
Summary
by MITRE • 11/21/2022
The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The Popup Maker WordPress plugin vulnerability CVE-2022-3690 represents a critical stored cross-site scripting flaw that affects versions prior to 1.16.11. This vulnerability specifically targets the plugin's handling of popup options where insufficient sanitization and escaping mechanisms are implemented, creating a pathway for malicious code execution within the WordPress administration environment. The flaw is particularly concerning because it allows users with administrative privileges to inject malicious scripts that persist in the database and execute whenever affected pages are loaded.
The technical nature of this vulnerability stems from the plugin's failure to properly validate and sanitize user input within its popup configuration options. When administrators configure popup settings through the WordPress admin interface, the plugin stores these values directly into the database without adequate filtering mechanisms. This creates a stored XSS vector where malicious scripts can be injected into popup parameters and subsequently executed in the context of other administrators' browsers. The vulnerability is exacerbated by the fact that even when WordPress multisite installations restrict the unfiltered_html capability, the plugin's insufficient sanitization allows high-privilege users to bypass these security restrictions.
From an operational impact perspective, this vulnerability enables attackers who have gained administrative access to the WordPress site to execute persistent malicious scripts that can steal session cookies, redirect users to malicious sites, or perform additional attacks against other administrators. The stored nature of the vulnerability means that once exploited, the malicious code remains active until manually removed from the database, potentially allowing for extended periods of unauthorized access and data exfiltration. This makes the vulnerability particularly dangerous in multi-user environments where administrators frequently interact with the plugin's configuration interface.
The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and it maps to ATT&CK technique T1566.001 related to spearphishing attachments and T1059.001 for command and scripting interpreter. Organizations using the Popup Maker plugin should immediately upgrade to version 1.16.11 or later to remediate this vulnerability. Additionally, administrators should implement proper input validation procedures, regularly audit plugin configurations, and consider implementing web application firewalls to detect and prevent exploitation attempts. The security community should also monitor for similar vulnerabilities in other WordPress plugins that handle user-generated content through administrative interfaces, as this represents a common pattern of insufficient sanitization in content management systems.