CVE-2025-9490: Popup Maker WordPress XSS Vulnerability

CVE-2025-9490 Overview

CVE-2025-9490 is a stored Cross-Site Scripting (XSS) vulnerability in the Popup Maker plugin for WordPress. The flaw affects all versions up to and including 1.20.6. It stems from insufficient input sanitization and output escaping on the title parameter. Authenticated users with Contributor-level access or higher can inject arbitrary web scripts into pages. The injected payload executes in the browser of any user who views the affected page. The weakness is tracked under CWE-79.

Critical Impact
Authenticated contributors can persist JavaScript that executes against site visitors and administrators, enabling session theft, forced actions, and administrative account takeover.

Affected Products

Popup Maker plugin for WordPress — all versions through 1.20.6
WordPress sites that permit Contributor-level (or higher) registration
Multi-author WordPress environments running the vulnerable plugin

Discovery Timeline

2025-09-26 - CVE-2025-9490 published to the National Vulnerability Database (NVD)
2026-10-11 - Last updated in NVD database

Technical Details for CVE-2025-9490

Vulnerability Analysis

The vulnerability resides in the Popup Maker plugin's handling of the title parameter. The plugin fails to sanitize input and escape output when rendering the field. An attacker with a Contributor account can submit a payload that includes HTML or JavaScript inside the title value. The payload is stored in the database and reflected into pages generated by the plugin. When a logged-in administrator or site visitor loads the affected page, the script runs in the context of their session.

Stored XSS in a WordPress plugin is particularly impactful because an administrator viewing the content executes attacker-controlled JavaScript with full WordPress session privileges. This enables theft of authentication cookies, creation of new administrator accounts, injection of persistent backdoors into themes or plugins, and tampering with site content served to end users.

Root Cause

The root cause is missing input sanitization and missing output escaping on a user-controllable field. WordPress exposes helper functions such as sanitize_text_field() for input and esc_html() or esc_attr() for output. The vulnerable code path in the Popup Maker importer handling, referenced in includes/importer/easy-modal-v2.php, writes the title value to output without the required escaping. See the WordPress Plugin Source Code for the vulnerable file.

Attack Vector

Exploitation requires an authenticated account with Contributor-level privileges or higher. The attacker crafts a popup or related content and places a JavaScript payload inside the title field. The content is saved to the WordPress database. Any user who subsequently loads a page that renders that title triggers the stored script in their browser. No user interaction beyond page navigation is required to trigger execution. See the Wordfence Vulnerability Report for additional technical context.

No verified public proof-of-concept code is available. The vulnerability pattern follows standard stored XSS exploitation in WordPress plugins.

Detection Methods for CVE-2025-9490

Indicators of Compromise

Popup Maker records in wp_posts or related tables containing <script>, onerror=, onload=, or javascript: strings in the title field
Newly created WordPress administrator accounts that were not provisioned by legitimate workflows
Modified theme or plugin files, especially functions.php, with injected PHP or JavaScript
Outbound requests from browsers of logged-in administrators to attacker-controlled domains following page views

Detection Strategies

Query the WordPress database for popup records whose title contains HTML tags or event-handler attributes
Audit all Contributor, Author, and Editor accounts for recently submitted popup content
Inspect web server access logs for POST requests to the popup editor endpoints from low-privilege accounts
Compare installed Popup Maker version against the fixed release and flag any instance at 1.20.6 or earlier

Monitoring Recommendations

Enable WordPress audit logging to capture content creation and edits by non-administrator roles
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on admin pages
Alert on creation of new administrator accounts, role elevations, and changes to active theme files
Track plugin version inventory across all WordPress properties and flag outdated Popup Maker installations

How to Mitigate CVE-2025-9490

Immediate Actions Required

Update the Popup Maker plugin to a version later than 1.20.6 as soon as the vendor-supplied fix is available
Review all existing popup records for stored script content and remove or sanitize affected entries
Audit Contributor, Author, and Editor accounts and revoke any that are unused or untrusted
Rotate administrator session cookies and credentials if indicators of exploitation are present

Patch Information

The vendor has published updates to the plugin repository. Review the WordPress Changeset History for the specific code change addressing the sanitization gap. Update instructions and current releases are listed on the Popup Maker Plugin Developers page.

Workarounds

Restrict user registration and remove the Contributor role from untrusted accounts until the plugin is patched
Deploy a web application firewall (WAF) rule that blocks HTML tags and event handlers in POST parameters targeting Popup Maker endpoints
Enforce a strict Content Security Policy that disallows inline scripts on the WordPress admin interface
Temporarily deactivate the Popup Maker plugin on sites where upgrade is not immediately feasible

bash

# Example WP-CLI commands to inventory and update the plugin
wp plugin get popup-maker --field=version
wp plugin update popup-maker
wp user list --role=contributor --fields=ID,user_login,user_registered