PT-2025-27767

CVE-2024-5647

Published

2025-07-02

Updated

2026-08-25

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WordPress plugins using Magnific Popups library version 1.1.0

Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Magnific Popups library, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages. This enables the execution of scripts whenever a user accesses an injected page.

Recommendations: For WordPress plugins using the Magnific Popups library version 1.1.0, update the Magnific Popups library to version 1.2.0, which disables the loading of HTML within certain fields by default to fix the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Craig Smith

Webbernaut

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers