CVE-2025-13900 WP Popup Magic <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute

The WP Popup Magic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the wppumend shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-13900

CVE-2025-13900 refers to the WP Popup Magic plugin for WordPress, with a Stored XSS vulnerability in the shortcode [wppum_end] via the name parameter. The connected Wordfence summary confirms the flaw affects WP Popup Magic and lists it as an authenticated (Contributor+) Stored Cross‑Site Scripti...