Popup Maker EUVD-2026-82855

Injection requires only that the site expose a Popup Maker optin/newsletter/subscribe form accepting the values[Name] field - reachable by unauthenticated visitors in default configurations of the plugin (versions <=1.24.0). Execution, however, is gated: a logged-in administrator (or user with subscriber-table access) must open the Popup Maker Subscribers list-table in wp-admin and click a contextual help-tab anchor, which triggers the jQuery(link.attr('href')) sink in wp-admin/js/common.js. The limiting factors are therefore this required privileged admin interaction and the specific help-tab click path, plus the plugin being present and its subscriber/optin feature in use - which meaningfully constrains real-world exploitation despite the unauthenticated injection surface.

The vendor/Wordfence CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2) rates this a network, low-complexity, unauthenticated stored XSS with a scope change and limited confidentiality/integrity impact. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so this is a real-but-not-emergency issue rather than a confirmed widespread threat. The most important nuance is a conflict between the vector's UI:N and the description's own mechanism: the injected payload does not fire on mere page load but only when a logged-in admin views the subscribers/optin table AND clicks a contextual help-tab anchor, whose href is passed to a jQuery(link.attr('href')) sink in wp-admin/js/common.js - that click is genuine user interaction, so UI:N is generous and effective real-world risk is lower than the 7.2 implies. The compensating factor that keeps this meaningful is the injection side being truly unauthenticated (PR:N): any visitor can seed the payload via the public optin/subscribe Name field, and successful execution runs in a privileged wp-admin context (hence S:C). Net: prioritize patching because of the unauth injection vector and large install base, but treat it as targeted/admin-interaction-gated, not automatable mass exploitation.

An unauthenticated attacker submits a Popup Maker newsletter/optin form with a crafted values[Name] value containing HTML entities inside an allowed attribute; wp_kses lets it survive on output. Later a site administrator opens the Subscribers list-table in wp-admin and clicks a contextual help-tab anchor, at which point common.js's jQuery(link.attr('href')) decodes and evaluates the entity-encoded payload, executing attacker script in the admin session. No public POC is identified at time of analysis.