CVE-2025-4205 Overview
CVE-2025-4205 is a Stored Cross-Site Scripting (XSS) vulnerability in the Popup Maker plugin for WordPress. The flaw exists in all versions up to and including 1.20.4. The vulnerability stems from insufficient input sanitization and output escaping on the popupID parameter. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page. This vulnerability is tracked under [CWE-79] and impacts an active WordPress plugin with a large installation base.
Critical Impact
Authenticated Contributor-level attackers can inject persistent JavaScript that executes in visitor browsers, enabling session theft, credential harvesting, and administrator account takeover.
Affected Products
- Popup Maker plugin for WordPress, all versions through 1.20.4
- WordPress sites permitting Contributor-level registration or higher
- Any front-end visitor rendering pages containing an injected popup
Discovery Timeline
- 2025-06-03 - CVE-2025-4205 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4205
Vulnerability Analysis
The Popup Maker plugin renders popup content on WordPress pages using client-side JavaScript. The plugin accepts a popupID parameter that is used to reference and render popup elements on the page. The plugin fails to sanitize input on write and fails to escape output on render. As a result, attacker-supplied data placed into the popupID context is interpreted as HTML and JavaScript rather than as inert text.
Because the payload is stored inside the WordPress database and rendered every time an affected page loads, exploitation persists across sessions. Any user visiting the page—including administrators—executes attacker JavaScript in their authenticated browser context. Common outcomes include session cookie theft, forced administrative actions via CSRF chains, and redirection to attacker-controlled infrastructure.
Root Cause
The root cause is the plugin's handling of the popupID value in assets/js/site.js, where the value is concatenated into DOM operations without escaping. Server-side write paths accept the value without stripping HTML control characters. This dual failure of input sanitization and output escaping is the classic pattern for stored XSS under CWE-79. Fixed logic in WordPress Changeset #3303770 applies proper escaping before the parameter is consumed.
Attack Vector
An attacker registers or already controls a Contributor-level (or higher) WordPress account. The attacker submits content that includes a malicious popupID payload, storing script content in the plugin's data. When any visitor loads a page invoking the popup logic, the browser parses and executes the injected script. Privilege elevation follows if an administrator triggers the payload. See the vulnerable JavaScript source and the Wordfence vulnerability analysis for further technical detail. No public proof-of-concept exploit is currently listed for this CVE.
Detection Methods for CVE-2025-4205
Indicators of Compromise
- Post or page metadata containing <script>, onerror=, onload=, or javascript: sequences in fields tied to Popup Maker
- Unexpected outbound requests from visitor browsers to unknown domains after loading pages that render popups
- New or modified WordPress administrator accounts created shortly after Contributor account activity
- Popup Maker records where the popupID value contains non-alphanumeric characters or HTML entities
Detection Strategies
- Query the wp_posts and wp_postmeta tables for Popup Maker entries containing HTML tags or event handler attributes
- Review WordPress audit logs for content submissions by Contributor-level accounts referencing popup shortcodes
- Inspect rendered HTML on public pages for inline script tags injected outside expected template regions
- Correlate plugin version telemetry against the 1.20.4 and earlier ceiling to identify exposed sites
Monitoring Recommendations
- Enable WordPress security logging for content edits performed by low-privilege roles
- Deploy a Content Security Policy (CSP) that blocks inline scripts and report violations to a central collector
- Monitor administrator sessions for anomalous XHR or fetch calls following visits to author-generated pages
- Alert on newly promoted user roles or capability changes originating from front-end page loads
How to Mitigate CVE-2025-4205
Immediate Actions Required
- Update the Popup Maker plugin to the version that includes WordPress Changeset #3303770, released after 1.20.4
- Audit all existing Popup Maker configurations for suspicious HTML or JavaScript content in the popupID field
- Review Contributor, Author, and Editor accounts for legitimacy and rotate credentials where warranted
- Force a session reset for administrator accounts that may have loaded compromised pages
Patch Information
The vendor addressed the vulnerability by applying proper output escaping to the popupID parameter. See the fix in WordPress Changeset #3303770 and the plugin's developer information page for release details. Administrators should upgrade through the WordPress plugin dashboard or via WP-CLI.
Workarounds
- Temporarily deactivate the Popup Maker plugin until the patched version is deployed
- Restrict Contributor-level and higher account creation and require manual approval for new accounts
- Deploy a web application firewall (WAF) rule that blocks HTML tags and event handlers in Popup Maker request parameters
- Enforce a strict Content Security Policy on the WordPress front end to neutralize injected inline scripts
# Configuration example
wp plugin update popup-maker
wp plugin list --name=popup-maker --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
