The Popup Builder & Popup Maker plugin for WordPress by OptinMonster contains a stored cross-site scripting vulnerability identified as CVE-2024-4045. This issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'campaign_id' parameter. Authenticated users with contributor-level permissions or above can exploit this flaw to inject malicious scripts that persist and execute in the context of other users viewing the affected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no indication of an official patch or vendor advisory at this time, and no known exploits have been reported in the wild.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts via the 'campaign_id' parameter. This can lead to unauthorized script execution in users' browsers, potentially compromising confidentiality and integrity of user data within the affected WordPress environment. There is no reported impact on availability. The vulnerability requires authenticated access with contributor-level permissions or above, limiting exposure to trusted users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher permissions to trusted users only. Monitor for plugin updates from OptinMonster and apply them promptly once available. Avoid using or exposing the vulnerable 'campaign_id' parameter in untrusted contexts.