The Popup Maker WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, user-supplied attributes in the plugin's shortcodes are not adequately sanitized or escaped, allowing authenticated users with contributor-level or higher permissions to inject malicious scripts. These scripts execute in the context of any user who views the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 1.18.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, and partial impact on confidentiality and integrity. There is no vendor advisory or patch link currently available, and no known exploits have been reported.

An authenticated attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user data confidentiality and integrity. The vulnerability does not impact availability. Because the attack requires authenticated access at contributor level or above, the risk is limited to environments where such users exist. No known exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level and higher permissions to trusted users only. Avoid using the vulnerable plugin versions or disable the plugin if possible. Monitor official channels for updates from the vendor danieliser regarding patches or mitigations.