Themify Popup CVE-2026-109989

Requires an authenticated account with author-level capability or higher on the target WordPress site; the attacker injects unsanitized input through the 'popup_width_unit' parameter while configuring a Themify Popup (plugin versions up to and including 1.4.7), where it is stored due to insufficient input sanitization and output escaping. Execution is passive from the victim's side - the stored script runs automatically whenever any user accesses the injected page, requiring no attacker-side user interaction. The principal limiting factor is the author-level authentication prerequisite, meaning sites that do not grant author or higher roles to untrusted users face minimal exposure.

This is a moderate-severity stored XSS (CVSS 6.4) whose real-world risk is constrained primarily by its privilege requirement. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) confirms network reach and low complexity, but PR:L means the attacker must already hold at least author-level credentials on the WordPress site - not an anonymous remote attacker. The scope change (S:C) correctly reflects that the injected script executes in the browser context of other users (including administrators) who view the injected page, which is why confidentiality and integrity are rated Low rather than None. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation: exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a legitimate but not urgent priority - patch in normal cycles. The main escalation path is an untrusted or compromised author account being used to backdoor the admin session via stored script, so risk rises on multi-author sites and falls on single-admin deployments where author-level accounts do not exist.

An attacker who has obtained or been granted author-level access to a WordPress site injects a malicious script into the 'popup_width_unit' parameter when configuring a Themify Popup. The payload is stored and later executes in the browser of any user - including an administrator - who views the affected page, enabling session/cookie theft or admin-context actions. No public exploit code was identified in the provided data.