CVE-2026-87915

The Popup Maker WordPress plugin is vulnerable to unauthenticated stored cross-site scripting (XSS) via the values[Name] parameter in all versions up to and including 1.24.0 . The root cause is insufficient input sanitization and output escaping : although wp_kses is applied on output, HTML entit...