CVE-2025-26774: Easy Popups Plugin XSS Vulnerability

CVE-2025-26774 Overview

CVE-2025-26774 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Rock Solid Responsive Modal Builder for High Conversion – Easy Popups WordPress plugin. The flaw stems from Improper Neutralization of Input During Web Page Generation [CWE-79] and impacts all plugin versions from initial release through 1.5.0. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser when the link is visited. Successful exploitation requires user interaction but no authentication, and the scope is changed because injected scripts run in the context of the affected site.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and unauthorized actions on the WordPress site.

Affected Products

Rock Solid Responsive Modal Builder for High Conversion – Easy Popups (easy-popups)
All plugin versions through 1.5.0
WordPress sites running the vulnerable easy-popups plugin

Discovery Timeline

2025-02-22 - CVE-2025-26774 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26774

Vulnerability Analysis

The vulnerability is a reflected XSS issue [CWE-79] in the easy-popups WordPress plugin. The plugin fails to properly neutralize user-supplied input before reflecting it back into generated web pages. An attacker crafts a URL containing JavaScript payloads in vulnerable parameters and lures a user to click the link. The server reflects the unsanitized input into the HTML response, and the victim's browser executes the attacker-controlled script. Because the affected scope changes during exploitation, injected code can interact with components outside the immediate security boundary of the plugin.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders user-controlled request parameters into HTML responses. The plugin does not apply WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses() to relevant input before output, allowing arbitrary HTML and JavaScript to be embedded in the rendered page.

Attack Vector

Exploitation requires the attacker to deliver a malicious link to a victim, typically through phishing, a forum post, or a malicious advertisement. When the victim clicks the link while browsing a site running a vulnerable easy-popups installation, the reflected payload executes in their browser. If the victim is an authenticated WordPress administrator, the attacker can leverage the executed script to perform privileged actions, exfiltrate session cookies, or pivot to persistent compromise of the site. See the Patchstack XSS Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-26774

Indicators of Compromise

Web server access logs containing requests to easy-popups endpoints with URL parameters carrying <script>, javascript:, onerror=, or onload= strings
HTTP referers originating from suspicious external domains immediately preceding administrator sessions
Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting plugin-rendered pages
New or modified WordPress administrator accounts created shortly after a user clicked an external link

Detection Strategies

Inspect HTTP request and response pairs for reflected payloads where query parameter content appears unescaped in the response body
Deploy Web Application Firewall (WAF) rules to flag URL parameters containing HTML or JavaScript syntax targeting easy-popups paths
Correlate browser-side Content Security Policy (CSP) violation reports with WordPress access logs

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized analytics platform for parameter-level inspection
Monitor plugin version inventory across managed WordPress installations and alert on any host still running easy-popups version 1.5.0 or earlier
Track administrator authentication events and session anomalies that may indicate cookie theft following an XSS payload execution

How to Mitigate CVE-2025-26774

Immediate Actions Required

Update the easy-popups plugin to a version later than 1.5.0 once the vendor publishes a fixed release
Audit WordPress sites for the presence of the vulnerable plugin and disable it where no patched version is yet available
Force a password reset and invalidate active sessions for administrator accounts on potentially exposed sites

Patch Information

At the time of NVD publication, the vulnerability affects all versions of easy-popups through 1.5.0. Administrators should consult the Patchstack XSS Vulnerability Report for current patch status and apply the vendor's fixed release as soon as it becomes available.

Workarounds

Deactivate and remove the easy-popups plugin until a patched version is installed
Deploy a WAF rule that blocks requests to plugin endpoints containing HTML tags or JavaScript event handlers in query parameters
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Train site administrators to avoid clicking unsolicited links pointing to their own WordPress sites with unusual query strings

bash

# Example WAF rule (ModSecurity) to block reflected XSS payloads targeting easy-popups
SecRule REQUEST_URI "@contains /wp-content/plugins/easy-popups/" \
  "chain,deny,status:403,id:1002601,msg:'Block potential XSS targeting easy-popups (CVE-2025-26774)'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"