WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS)

# Exploit Title: WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 03/11/2021
# Exploit Author: Luca Schembri
# Vendor Homepage: https://www.essentialplugin.com/
# Software Link: https://wordpress.org/plugins/popup-anything-on-click/
# Version: < 2.0.4

** Summary **

A user with a low privileged user can perform XSS-Stored attacks.


** Plugin description **

Popup Anything is the best popup builder and marketing plugin that
helps you get more email subscribers, increase sales and grow your
business.


Manage powerful modal popup for your WordPress blog or website. You
can add an unlimited popup with your configurations.


** Vulnerable page **

http://{WEBSITE}/wp-admin/post.php?post={ID}&action=edit


** PoC **

Go on the "Popup Anything - Settings" tab and select "Simple Link" as
"Link Type". Select "Link Test" and use this payload:

test" onclick="alert(1)

Save the popup and reload the page. Now click on "Link Text" and it
will execute the javascript code

The same attack can be exploited with "Button Text" and "Popup width" fields.


** Remediation **

Upgrade to 2.0.4 version or later