CVE-2026-87915

Name of the Vulnerable Software and Affected Versions Popup Maker versions prior to 1.24.1

Description The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. Unauthenticated attackers can inject arbitrary web scripts through the values[Name] parameter due to insufficient input sanitization and output escaping. These scripts execute when a user accesses an affected page. The issue occurs because the wp kses sanitization is insufficient, allowing HTML entities within attribute values to persist and be evaluated by the jQuery(link.attr('href')) sink in the wp-admin/js/common.js file when a contextual help tab anchor is clicked.

Recommendations Update to a version later than 1.24.0.