206 matches found
Popup-Maker < 1.8.12 - Broken Authentication
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the doaction function to invoke certain popmake or pum methods, as demonstrated by controlling content and delivery of popmake-system-info.txt aka the...
Exploit for CVE-2026-87915
CVE-2026-87915 — Popup Maker VDP-XSS-PROOF - valuesnam...
WordPress Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin Popup Maker versions = 1.24.0...
CVE-2026-87915
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15797
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-87915 Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...
EUVD-2026-82854
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...
EUVD-2026-82855
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15797
The Popup Maker WordPress plugin (versions up to and including 1.24.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the post_title field, caused by insufficient input sanitization and output escaping. An attacker with contributor-level access or higher can create a post containing an H...
CVE-2026-15797 Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-87915
The Popup Maker WordPress plugin is vulnerable to unauthenticated stored cross-site scripting (XSS) via the values[Name] parameter in all versions up to and including 1.24.0 . The root cause is insufficient input sanitization and output escaping : although wp_kses is applied on output, HTML entit...
CVE-2026-15797 Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-87915 Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...
CVE-2026-15797: Improper Neutralization of Input During Web Page Generation
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-87915: Improper Neutralization of Input During Web Page Generation
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...
WordPress Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Popup Maker versions = 1.24.0...
CVE-2026-28177
Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...
EUVD-2026-53949
Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...