The Popup Maker plugin for WordPress, developed by danieliser, suffers from a stored cross-site scripting vulnerability identified as CVE-2025-4205. This vulnerability is due to improper neutralization of input during web page generation (CWE-79) specifically via the 'popupID' parameter. Authenticated attackers with at least Contributor privileges can inject arbitrary scripts that persist and execute in the context of users visiting the injected pages. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact. The vulnerability affects all versions up to and including 1.20.4. No patch or official fix is documented in the provided data.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages generated by the Popup Maker plugin. This can lead to unauthorized actions performed in the context of other users, potentially compromising confidentiality and integrity of user data or sessions. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the Popup Maker plugin. Avoid exposing the 'popupID' parameter to untrusted input. Follow vendor channels for updates on patches or official mitigations.