CVE-2026-11996 is a stored cross-site scripting vulnerability in the Advanced Popups plugin for WordPress. The flaw arises from insufficient input sanitization and output escaping of the 'Notification Button Link' field, allowing authenticated attackers with author-level access or above to inject arbitrary web scripts. These scripts execute in the context of any user who accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions from 0 through 1.2.3 inclusive.

An attacker with author-level or higher privileges can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to partial confidentiality and integrity loss of user data (as indicated by the CVSS vector: low confidentiality and integrity impact, no availability impact). The vulnerability does not require user interaction beyond visiting the injected page.

No official patch or fix is currently referenced. Users should check the vendor's advisory for updates. Until a fix is available, limit author-level access to trusted users only to reduce risk. Monitor for plugin updates that address this vulnerability and apply them promptly once released.