CVE-2026-15797 is a stored cross-site scripting vulnerability in the Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder WordPress plugin. The vulnerability arises from improper neutralization of input during web page generation (CWE-79). Specifically, the post_title field is not properly sanitized or escaped, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. The attack vector involves creating a post with an HTML entity-encoded payload in the title, which bypasses the sanitize_text_field function on save and is later decoded and executed by the browser when rendered by the Select2 component.

An attacker with contributor-level access or higher can inject persistent malicious scripts into post titles. These scripts execute in the context of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions limited to the scope of the plugin and WordPress environment. The vulnerability does not affect unauthenticated users directly but requires authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider monitoring or disabling the affected plugin. Avoid using versions up to and including 1.24.0 where this vulnerability exists.