CVE-2026-87915 describes a stored cross-site scripting vulnerability in the Popup Maker plugin for WordPress (versions up to and including 1.24.0). The issue stems from improper neutralization of input during web page generation, specifically in the values[Name] parameter. The plugin applies wp_kses sanitization on output, but this is insufficient as HTML entities within allowed attribute values survive normalization and are later evaluated by a jQuery sink in wp-admin/js/common.js when a contextual help tab anchor is clicked. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected pages.

Successful exploitation allows an unauthenticated attacker to perform stored cross-site scripting attacks, leading to the execution of arbitrary scripts in the context of users accessing affected pages. This can result in information disclosure and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of the user. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and low confidentiality and integrity impacts without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable parameter or plugin functionality. Monitor vendor channels for updates and apply patches promptly once released.