Themify Popup
Monthly
Stored cross-site scripting in the Themify Popup plugin for WordPress (all versions up to and including 1.4.7) allows an authenticated user holding author-level privileges or higher to persist arbitrary script into the site's popup configuration via the 'popup_width_unit' parameter, which is then executed in the browser of any visitor or administrator who loads the injected page. Because the payload is stored rather than reflected, a single low-privilege write can compromise every subsequent page view, and the CVSS:3.1 scope-change rating (S:C) reflects that the injected script runs in the broader site context rather than an isolated component. Exploitation is gated by the author-level account prerequisite and requires no interaction from the victim (UI:N); there is no public exploit code or CISA KEV entry identified at time of analysis, and EPSS data was not supplied, so the practical risk is concentrated on multi-author sites that grant author or higher roles to untrusted or self-registered users.
Stored cross-site scripting in the Themify Popup plugin for WordPress (all versions up to and including 1.4.7) allows an authenticated user holding author-level privileges or higher to persist arbitrary script into the site's popup configuration via the 'popup_width_unit' parameter, which is then executed in the browser of any visitor or administrator who loads the injected page. Because the payload is stored rather than reflected, a single low-privilege write can compromise every subsequent page view, and the CVSS:3.1 scope-change rating (S:C) reflects that the injected script runs in the broader site context rather than an isolated component. Exploitation is gated by the author-level account prerequisite and requires no interaction from the victim (UI:N); there is no public exploit code or CISA KEV entry identified at time of analysis, and EPSS data was not supplied, so the practical risk is concentrated on multi-author sites that grant author or higher roles to untrusted or self-registered users.