Wp Magnific Popup
Monthly
Stored XSS in WP Magnific Popup WordPress plugin (versions through 1.0) enables authenticated attackers holding Author-level privileges or higher to persistently inject malicious scripts into WordPress pages by supplying unsanitized link URLs that the plugin renders unescaped in image load error messages. Any user visiting an affected page is silently targeted, making session hijacking, credential harvesting, or malicious redirects achievable without further attacker interaction after initial payload placement. A publicly available POC is confirmed by WPScan, though EPSS sits at only 0.19% (9th percentile), reflecting that opportunistic mass exploitation has not materialized despite exploit accessibility.
Stored XSS in WP Magnific Popup WordPress plugin (versions through 1.0) enables authenticated attackers holding Author-level privileges or higher to persistently inject malicious scripts into WordPress pages by supplying unsanitized link URLs that the plugin renders unescaped in image load error messages. Any user visiting an affected page is silently targeted, making session hijacking, credential harvesting, or malicious redirects achievable without further attacker interaction after initial payload placement. A publicly available POC is confirmed by WPScan, though EPSS sits at only 0.19% (9th percentile), reflecting that opportunistic mass exploitation has not materialized despite exploit accessibility.