CVE-2025-24746 Overview
CVE-2025-24746 is a stored cross-site scripting (XSS) vulnerability in the Popup Maker plugin for WordPress, developed by Daniel Iser (Code Atlantic). The flaw affects all versions of the popup-maker plugin up to and including 1.20.2. An authenticated attacker with low privileges can inject malicious JavaScript that persists in the application and executes in the browsers of users who view affected pages. The vulnerability is classified under [CWE-79] and requires user interaction to trigger the payload.
Critical Impact
Authenticated contributors can store JavaScript payloads that execute in administrator browsers, enabling session theft, account takeover, and further compromise of the WordPress site.
Affected Products
- Popup Maker WordPress plugin versions up to and including 1.20.2
- WordPress sites running the code-atlantic/popup_maker plugin
- WordPress installations that permit contributor or higher role registrations
Discovery Timeline
- 2025-01-24 - CVE-2025-24746 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24746
Vulnerability Analysis
The vulnerability results from improper neutralization of user-supplied input during web page generation within the Popup Maker plugin. The plugin fails to sanitize or escape input passed into popup configuration or content fields before rendering it back to the DOM. An attacker with authenticated access can inject JavaScript that is stored server-side and executed when other users load pages containing the popup output.
The scope-changed nature of the flaw means the injected script executes in the context of any user who renders the affected page, including administrators. Successful exploitation can lead to session hijacking, forced administrative actions via CSRF-style flows, credential harvesting through fake login prompts, and pivoting to full site takeover.
Root Cause
The root cause is missing output encoding and insufficient input validation in the plugin's popup rendering logic. Fields that accept user-controlled strings do not apply WordPress escaping helpers such as esc_html(), esc_attr(), or wp_kses_post() before echoing content into HTML context. This allows raw <script> tags and event handler attributes to survive into the rendered page.
Attack Vector
Exploitation requires network access, low-level authenticated privileges, and user interaction to trigger the payload. An attacker logs in to a WordPress site running a vulnerable version of Popup Maker, crafts popup content containing a JavaScript payload, and saves it. When a victim, typically an administrator or logged-in editor, visits a page where the popup is rendered, the browser executes the stored script under the site's origin. See the Patchstack XSS Vulnerability Report for additional technical context.
No public proof-of-concept exploit code is available at this time. The vulnerability mechanism follows standard stored XSS patterns in WordPress plugins that render user-controlled input without escaping.
Detection Methods for CVE-2025-24746
Indicators of Compromise
- Popup content or configuration fields in the WordPress database (wp_posts, wp_postmeta) containing <script> tags, javascript: URIs, or DOM event handlers such as onerror, onload, or onclick.
- Outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading pages that render Popup Maker popups.
- Unexpected creation of new administrator accounts or modifications to user roles following administrator visits to popup-rendered pages.
Detection Strategies
- Query the WordPress database for popup post types and metadata containing HTML tags, script sequences, or encoded payloads such as <script.
- Deploy web application firewall rules that inspect POST requests to wp-admin/post.php and popup editor endpoints for XSS signatures.
- Correlate authenticated low-privilege user activity with subsequent administrator session anomalies in web server access logs.
Monitoring Recommendations
- Monitor plugin editor activity for contributor and author roles saving popup content containing HTML or JavaScript.
- Alert on Content Security Policy violation reports originating from pages that render Popup Maker output.
- Track version inventory of the Popup Maker plugin across managed WordPress deployments and flag installations at or below 1.20.2.
How to Mitigate CVE-2025-24746
Immediate Actions Required
- Update the Popup Maker plugin to a version above 1.20.2 as soon as the vendor patch is applied and validated in a staging environment.
- Audit existing popup content and metadata for previously injected payloads and remove any unauthorized script or event handler content.
- Rotate administrator session cookies and reset credentials for privileged accounts that may have loaded compromised popups.
Patch Information
Code Atlantic addresses the vulnerability in Popup Maker versions above 1.20.2. Review the Patchstack XSS Vulnerability Report for the fixed version reference and confirm the installed version in the WordPress plugin dashboard after updating.
Workarounds
- Restrict popup editing permissions to trusted administrator accounts by removing capabilities from lower-privileged roles until the plugin is patched.
- Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Disable or uninstall the Popup Maker plugin on sites that do not actively use popup functionality.
# Verify installed Popup Maker version and remove if vulnerable
wp plugin get popup-maker --field=version
wp plugin update popup-maker
# Optional: deactivate until patched build is validated
wp plugin deactivate popup-maker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
