CVE-2026-28177 in Popup Maker Plugin
Summary
by MITRE • 08/06/2026
Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
Popup Maker is a popular WordPress plugin designed to create and manage popups on websites, with over 1 million active installations as of 2023. This vulnerability affects versions up to and including 1.23.0, where an unauthenticated cross site scripting flaw exists in the plugin's handling of user input within popup creation and management interfaces. The vulnerability stems from insufficient input validation and output sanitization mechanisms that fail to properly escape or filter malicious script content submitted through various administrative forms and AJAX endpoints.
The technical implementation of this XSS vulnerability occurs when administrators or users with appropriate privileges create or modify popups containing malicious JavaScript code in fields such as popup content, custom CSS, or URL parameters. The plugin's backend processes these inputs without adequate sanitization before rendering them in the browser context, allowing attackers to inject persistent or reflected scripts that execute in the victim's browser when they view affected popup content. This vulnerability specifically maps to CWE-79 "Improper Neutralization of Input During Web Page Generation" and aligns with ATT&CK technique T1566.001 "Phishing via Social Media" as attackers can craft malicious popups that redirect users or steal session cookies.
The operational impact of this vulnerability extends beyond simple script execution, as it provides threat actors with potential access to administrative interfaces through session hijacking or credential theft mechanisms. An attacker who gains access to an administrator's browser session could modify popup configurations to inject additional malicious payloads, potentially escalating privileges or exfiltrating sensitive data from the WordPress installation. The vulnerability is particularly dangerous in multi-user environments where less privileged users might have access to popup creation features, as this bypasses typical privilege boundaries within the CMS. Additionally, the persistent nature of some XSS payloads means that once exploited, malicious scripts can continue executing against all subsequent users who view affected popups until the vulnerability is patched.
Mitigation strategies include immediate patching to version 1.23.1 or later, which implements proper input sanitization and output escaping mechanisms for all user-supplied content within popup creation interfaces. Administrators should also implement additional security measures such as restricting user roles that can create or modify popups, implementing Content Security Policy headers to limit script execution, and conducting regular security audits of plugin configurations. The WordPress security team recommends verifying the integrity of all plugin files through checksum verification and monitoring for suspicious activity in popup management areas. Organizations should also consider implementing web application firewalls that can detect and block malicious script injection attempts, particularly targeting known XSS patterns in AJAX endpoints associated with the affected plugin versions.