CVE-2026-15797

Name of the Vulnerable Software and Affected Versions Popup Maker versions prior to 1.25.0

Description The Popup Maker plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts by creating a post with an HTML entity-encoded payload in the post title variable. This payload bypasses the sanitize text field() function during the save process and is subsequently decoded and executed by the browser when rendered by the Select2 component.

Recommendations Update to a version later than 1.24.0.