CVE-2026-87915: 
WordPress vulnerability analysis and mitigation

CVE-2026-87915 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder" plugin for WordPress. It affects all versions up to and including 1.24.0, and can be exploited by unauthenticated attackers to inject arbitrary web scripts into pages. The vulnerability stems from insufficient input sanitization and output escaping of the values[Name] parameter. It carries a CVSS v3.1 base score of 7.2 (High) (Feedly).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The wp_kses sanitization applied on output is insufficient because HTML entities within allowed attribute values survive normalization intact and are subsequently evaluated by the jQuery(link.attr('href')) sink in wp-admin/js/common.js when a contextual help tab anchor is clicked. This creates a DOM-based execution path for attacker-supplied payloads injected via the values[Name] parameter, requiring no authentication or user privileges to plant the malicious script (Feedly).

Successful exploitation allows unauthenticated attackers to persistently store malicious JavaScript in WordPress pages, which executes in the context of any user — including administrators — who visits the affected page. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection to malicious sites. Because the scope is changed (S:C in CVSS), the injected script can affect resources beyond the vulnerable plugin itself, including the broader WordPress admin environment (Feedly).

As of the disclosure date (September 18, 2026), no public proof-of-concept exploit code or in-the-wild exploitation has been reported. The CVE status is listed as "Received" with no CISA KEV catalog entry or known threat actor attribution. The attack requires no authentication and low complexity, making it straightforward to exploit once a method is known (Feedly).

1. Reconnaissance: Identify WordPress sites running the Popup Maker plugin version ≤ 1.24.0 using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible readme.txt files.
2. Craft malicious payload: Prepare a stored XSS payload targeting the values[Name] parameter. Because wp_kses is bypassed via HTML entity encoding within allowed attribute values, craft a payload such as javascript:alert(document.cookie) or a more sophisticated payload that survives wp_kses normalization.
3. Submit payload: Submit the crafted payload through the plugin's unauthenticated input surface (e.g., a popup form or configuration endpoint) that processes the values[Name] parameter, storing the malicious value in the WordPress database.
4. Trigger execution: Wait for an administrator or privileged user to visit a page containing the injected popup or click a contextual help tab anchor in wp-admin, causing jQuery(link.attr('href')) in wp-admin/js/common.js to evaluate the stored payload.
5. Achieve objective: The executed script can exfiltrate session cookies, perform actions on behalf of the victim (e.g., create rogue admin accounts), or redirect users to attacker-controlled infrastructure (Feedly).

• Logs: WordPress access logs showing unauthenticated POST requests to popup-related endpoints with encoded or suspicious values in the values[Name] parameter; repeated requests from a single IP to popup submission endpoints.
• Database: Unexpected JavaScript or HTML entity-encoded script content (e.g., javascript:, javascript:) stored in popup configuration fields within the wp_pum_popups or related plugin database tables.
• Network: Outbound requests from admin browsers to unknown external domains shortly after admin page loads, potentially indicating cookie exfiltration or beacon callbacks.
• File System: No direct file system artifacts expected for stored XSS, but monitor for new or modified WordPress admin user accounts created without authorization as a secondary indicator of successful exploitation (Feedly).

Users should update the Popup Maker plugin to a version beyond 1.24.0 as soon as a patched release is made available by the vendor (danieliser/code-atlantic). In the interim, site administrators should consider disabling the plugin or restricting access to popup configuration endpoints via WAF rules that block encoded JavaScript patterns in input parameters. Implementing a Web Application Firewall (WAF) rule to detect and block XSS payloads targeting the values[Name] parameter is a recommended short-term workaround (Feedly).