The Timersys WP Popups plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) due to improper input neutralization during web page generation. This flaw allows an attacker with high privileges and requiring user interaction to inject malicious scripts that could impact confidentiality, integrity, and availability to a limited extent. The vulnerability affects all versions through 2.1.5.5. No vendor advisory or patch information is currently provided, and no known active exploitation has been reported.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of users viewing the affected popup content. This may lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. However, exploitation requires user interaction and high privileges, reducing the overall risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access to the plugin and avoid interacting with untrusted popup content. Monitor vendor channels for updates regarding patches or mitigations.