The Login/Signup Popup plugin for WordPress by xootix suffers from a stored cross-site scripting vulnerability (CWE-79) in its xoo_el_action shortcode. This flaw arises from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied shortcode attributes. Authenticated attackers with contributor-level permissions or higher can exploit this to inject malicious scripts that persist and execute in the context of other users viewing the compromised pages. The vulnerability affects all versions up to 2.8.5 and carries a CVSS 3.1 score of 6.4 (medium severity). No patch or official remediation guidance is currently available from the vendor, and no exploits have been observed in the wild.

Successful exploitation allows authenticated users with contributor-level or higher privileges to inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to the execution of arbitrary JavaScript in the context of other users, potentially resulting in information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. The medium CVSS score reflects the need for authentication and the limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the vendor or WordPress security channels to apply any forthcoming patches promptly.