EUVD-2026-37556Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Stored XSS requires Author-level authentication (PR:H), victim page visit (UI:R), and scope change to browser context (S:C); no plausible availability impact from XSS alone warrants A:N.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.
AnalysisAI
Stored XSS in WP Magnific Popup WordPress plugin (versions through 1.0) enables authenticated attackers holding Author-level privileges or higher to persistently inject malicious scripts into WordPress pages by supplying unsanitized link URLs that the plugin renders unescaped in image load error messages. Any user visiting an affected page is silently targeted, making session hijacking, credential harvesting, or malicious redirects achievable without further attacker interaction after initial payload placement. A publicly available POC is confirmed by WPScan, though EPSS sits at only 0.19% (9th percentile), reflecting that opportunistic mass exploitation has not materialized despite exploit accessibility.
Technical ContextAI
WP Magnific Popup wraps the Magnific Popup jQuery lightbox library as a WordPress plugin, allowing content authors to embed responsive image and media popups via shortcodes or blocks. The vulnerability arises from the plugin failing to apply output encoding or sanitization to user-supplied link URL values before writing them into the DOM during image load error handling - a classic reflected-into-stored XSS pattern where persistent author content becomes the injection vector. The CPE identifier (cpe:2.3:a:unknown:wp_magnific_popup:*:*:*:*:*:*:*:*) covers all known versions through 1.0 with no lower-bound exclusion. Although NVD has not assigned a CWE, the root cause aligns with CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS). The CVSS Scope metric is Changed (S:C), confirming the payload executes in the victim browser's security context rather than the server's, crossing the WordPress application trust boundary into each visitor's session.
RemediationAI
No vendor-released patched version is confirmed at time of analysis - all available references, including WPScan (https://wpscan.com/vulnerability/30f408dd-4b9a-438c-8dc4-c6daafe237fe/) and VulDB (https://vuldb.com/vuln/371839), document the flaw through version 1.0 without identifying a successor release. The primary recommended action is to deactivate and remove the WP Magnific Popup plugin until the vendor releases a patched version, substituting it with an actively maintained lightbox alternative such as FooBox or Envira Gallery. As compensating controls, site administrators should audit and restrict Author-level role assignments to only fully trusted individuals, reducing the pool of accounts capable of planting payloads. Implementing a Content Security Policy header that disallows inline script execution (script-src 'self' without 'unsafe-inline') will materially reduce the damage any successfully injected XSS payload can cause, though it may require adjustments for other site functionality. Monitor the WPScan advisory URL for patch availability updates.
Share
External POC / Exploit Code
Leaving vuln.today