CVE-2026-15797: 
WordPress vulnerability analysis and mitigation

CVE-2026-15797 is a Stored Cross-Site Scripting (XSS) vulnerability in the Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress. It affects all versions up to and including 1.24.0, allowing authenticated attackers with contributor-level access or above to inject arbitrary web scripts via the post_title field. The vulnerability was published on September 18, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The vulnerability arises because the plugin applies sanitize_text_field() to the post_title on save, which strips raw HTML but does not account for HTML entity-encoded payloads (e.g., <script>). When the stored title is later retrieved via an AJAX handler and rendered by the Select2 JavaScript component in the admin interface, the browser decodes the HTML entities and executes the embedded script. Exploitation requires only contributor-level WordPress authentication and no additional user interaction beyond a victim loading the affected page (Wordfence, WP Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user (including administrators) who accesses a page where the injected popup title is rendered. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions, or further site compromise. The scope is marked as Changed, meaning the injected script can affect users and browser sessions beyond the attacker's own context, potentially enabling privilege escalation within the WordPress environment (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating a currently low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low privilege requirement (contributor-level) lowers the barrier for exploitation on sites with open contributor registration (Wordfence).

1. Gain contributor access: Register or obtain a contributor-level (or higher) account on the target WordPress site running Popup Maker ≤ 1.24.0.
2. Create a malicious post: Navigate to the WordPress post editor and create a new post (or popup). In the title field, enter an HTML entity-encoded XSS payload, such as <img src=x onerror=alert(document.cookie)>, which bypasses sanitize_text_field() on save.
3. Save the post: Submit the post. The encoded payload is stored in the database without being flagged by the sanitization function.
4. Trigger rendering via Select2: When an administrator or other privileged user accesses the Popup Maker admin interface (e.g., the popup selection dropdown powered by Select2), the AJAX handler retrieves the stored title and passes it to the Select2 component.
5. Script execution: The browser decodes the HTML entities in the title and executes the embedded script in the victim's browser session, enabling cookie theft, session hijacking, or further malicious actions (Wordfence, WP Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php with action parameters related to Popup Maker post/popup creation from low-privileged accounts.
• Database: Posts or popups in the wp_posts table with HTML entity-encoded script tags (e.g., <script>, <img src=x onerror=) in the post_title field.
• Network: Unexpected outbound requests from admin browsers to unknown external domains following interaction with the Popup Maker admin UI (indicative of data exfiltration via injected script).
• Logs: JavaScript errors or unusual AJAX responses in browser developer console logs when loading the Popup Maker admin selection interface.

Update the Popup Maker plugin to version 1.25.0 or later, which includes a fix that properly escapes output in the AJAX handler before passing titles to the Select2 component (WP Trac Changeset). As a temporary workaround, restrict contributor-level user registration and limit who can create posts/popups on the site. Site administrators should also audit existing popup titles in the database for HTML entity-encoded script payloads.